Integration Test Verify

[BLOCKING] Execute skill steps in declared order. NEVER skip, reorder, or merge steps without explicit user approval. [BLOCKING] Before each step or sub-skill call, update task tracking: set in_progress when step starts, set completed when step ends. [BLOCKING] Every completed/skipped step MUST include brief evidence or explicit skip reason. [BLOCKING] If Task tools are unavailable, create and maintain an equivalent step-by-step plan tracker with the same status transitions.

Quick Summary

Goal: Prove reviewed integration tests pass repeatably: run each relevant suite twice without DB reset using project-configured commands, after harvesting and verifying doc-declared environment preconditions; back every result with actual runner output, never assumptions.

Summary: read-this-if-nothing-else digest of the 5 main steps —

• Testability contract: resolve Unit/Integration/System/E2E applicability from runner/config evidence; record owner/root/data, copy-ready full + focused commands, zero-match behavior, CI/simple-Windows entry, unique run/data identity, and repeat proof; unresolved applicable fields block handoff, while non-applicable tiers require evidence-backed N/A.

• Step 1 — Read config + reference docs FIRST, then HARVEST preconditions: load docs/project-config.json → integrationTestVerify and obey its quickRunCommand; READ every referenceDocs file (else the project's integration-test reference doc) and harvest from it an explicit Environment Precondition Checklist — whatever that doc actually declares (services/containers, DB + migration/seed state, env vars, ports, credentials, startup script, isolation rules). Language-agnostic, so NEVER hardcode dotnet test; missing section → Fallback Mode. — why: reading the doc without extracting its preconditions changes nothing — the run still starts blind.

• Step 2 — Gate on a healthy system AND every harvested precondition: run systemCheckCommand AND verify each checklist item against real evidence; any unmet → STOP, mark ENVIRONMENT-BLOCKED, name the precondition + the doc line declaring it, point user at startupScript. — why: systemCheckCommand covers only what the config author thought to encode, so a doc-declared precondition it misses becomes a red suite blamed on the tests.

• Step 3 — Determine test projects: discover via testProjectPattern glob > testProjects list > git auto-detect; run only projects the change touches.

• Step 4 — Run the 2-run gate, fan out when many isolated projects: each relevant suite passes 2 consecutive green runs WITHOUT DB reset; any failure restarts from run 1. When several independent, per-DB-isolated projects exist, fan out one integration-tester sub-agent per project/group in parallel → barrier on ALL returns → aggregate; suites sharing a DB run sequentially. — why: parallel runs over a shared DB cross-contaminate and silently break the no-reset guarantee.

• Step 5 — Report from real output, fix at root, hand failures to the loop: report Passed/Failed/Skipped counts + failing names (only actual runner output proves a result); on failure diagnose test-bug vs service-bug and fix at the owning layer — NEVER weaken assertions, add skips, or mutate domain data to force green. ANY failure → recommend /workflow-integration-test-green, which owns the converge-to-green loop this skill does not (skip that recommendation when this run IS a round of that loop). — why: a snapshot that reports red and stops leaves the user hand-carrying every failure.

Workflow:

1. Read Config + Reference Docs — Load docs/project-config.json → integrationTestVerify, read the project's integration-test reference docs, harvest the Environment Precondition Checklist
2. System Check + Precondition Gate — Verify the system is healthy AND every harvested precondition is met before running
3. Determine Test Projects — Discover via testProjectPattern glob, testProjects list, or git auto-detect
4. Run Tests — Execute quickRunCommand on determined test projects for 2 consecutive runs; fan out parallel integration-tester sub-agents when many isolated projects must run
5. Report — Pass/fail counts, failed test names, next steps on failure

Key Rules:

• MUST read project config integrationTestVerify section before doing anything else
• MUST read project-specific reference docs named by integrationTestVerify.referenceDocs or the project's integration-test doc path before running tests
• MUST harvest an explicit Environment Precondition Checklist from those docs — derive each item from what the doc declares, NEVER from a fixed list in this skill — and verify every item before the first test command
• Use quickRunCommand from config — NEVER hardcode dotnet test or any language-specific command
• If system check fails → instruct user how to start system (reference startupScript from config)
• Any harvested precondition unmet → STOP, mark ENVIRONMENT-BLOCKED, cite the precondition + its doc line, and point the user at the setup step — NEVER run the suite anyway and NEVER report an environment failure as a failing test
• If config says local infrastructure, databases, services, or full system startup is required, treat that as a blocking prerequisite
• On test failure → diagnose root cause: test bug or service bug. NEVER weaken assertions.
• ANY failing test at the end of the run → recommend /workflow-integration-test-green as the next step (it owns the converge-to-green loop); omit that recommendation when this run is itself a round of that loop
• On an INTERMITTENT failure (red in one run, green in another) → adjudicate the cause first — (a) unrealistic scenario / compressed pacing, (b) harness topology amplification, or (c) genuine product race — and record the verdict with evidence BEFORE any change. NEVER resolve a flake by widening a timeout, adding a retry, or skipping
• Verification only passes after 2 consecutive successful runs of each relevant suite/project without DB reset
• When many independent, isolated test projects must run, fan out one integration-tester sub-agent per project (or balanced group) in parallel to speed it up — barrier on all returns, then aggregate; fall back to sequential when suites share a DB or aren't isolated
• Always report exact failure counts and names — "all passed" requires evidence

Be skeptical. Apply critical thinking. Every pass/fail claim needs actual test runner output.

First Principle — Easy to Change

The success metric of every coding decision is future change cost. DRY, SRP, abstraction, design patterns, naming, layering, tests — every technique exists to serve one goal: making the next change cheaper.

When evaluating code, refactor, test, or abstraction, ask: does this make next change cheaper or more expensive?

• Reject "best practices" raising change cost (premature abstraction, speculative generality, leaky indirection, ceremony without payoff).
• Name real enemies in findings: coupling, hidden state, duplicated knowledge, unclear intent, irreversible decisions exposed too early.
• Simpler design easy to change beats sophisticated design that isn't.

Apply this lens before invoking any specific rule, pattern, or checklist below — if downstream rule would raise change cost, this principle wins.

Step 1: Read Project Config + Reference Docs

Read docs/project-config.json and extract the integrationTestVerify section.

Expected config shape:
{
  "integrationTestVerify": {
    "guidance":             string   — instructions for the project's test run approach
    "referenceDocs":        string[] — project docs that explain integration-test setup/run prerequisites
    "quickRunCommand":      string   — test runner command (e.g., "dotnet test --no-build", "npm test", "pytest")
    "testProjectPattern":   string   — glob pattern to discover test projects (e.g., "**/*.IntegrationTests.csproj", "**/*.integration.spec.ts")
    "testProjects":         string[] — explicit list of test project paths (fallback if no pattern)
    "systemCheckCommand":   string   — shell command to check system readiness
    "runScript":            string   — path to CI-style full run script (reference only)
    "startupScript":        string   — path to system startup script (reference only)
  }
}

Config priority: testProjectPattern (auto-discovers via glob) > testProjects (explicit list) > git auto-detect (fallback).

If integrationTestVerify section is missing: proceed to Fallback Mode.

If section exists: display the guidance value to the user verbatim — it contains project-specific instructions the implementer wrote intentionally.

Then read the project-specific setup guidance before any system check or test command:

1. Read every file listed in integrationTestVerify.referenceDocs, if present.
2. If no referenceDocs list exists, read the integration-test reference doc indicated elsewhere in docs/project-config.json (for example a framework/testing integration test doc path), if present.
3. If config names runScript or startupScript, read those scripts when needed to understand startup, health checks, arguments, or labels. Use them as project-specific evidence, not generic assumptions.
4. If no project-specific reference exists, proceed only with the explicit config values and call out that the project should add reference docs to integrationTestVerify.

Step 1b: Harvest the Environment Precondition Checklist (BLOCKING — before any command)

Reading the reference doc is not the point; extracting what it requires of the environment is. From the docs and scripts just read, derive an explicit checklist of every precondition the test run depends on, then carry it into Step 2.

Derive, never enumerate. Take the items from what THIS project's doc actually declares — no fixed list here would survive a different stack. Typical shapes the doc may state: required services/containers up and healthy · database reachable, migrated, and seeded to a known baseline · message broker / queue / cache running · env vars, connection strings, ports, credentials, certificates · a startup or bootstrap script that must run first · build/restore performed before the run · per-suite isolation (own DB/schema/namespace) · required test data or fixtures · external dependency stubs.

Record it as a table before proceeding:

### Environment Precondition Checklist (harvested)

| # | Precondition | Declared by (doc:line / script) | How to verify | Status |
|---|--------------|---------------------------------|---------------|--------|
| 1 | {what must be true} | {file:line} | {command / observable} | PENDING |

Rules:

• MUST cite file:line (or script path) for every harvested item — an item with no source is an assumption, not a precondition.
• No reference doc found, or the doc declares no environment prerequisites → record No environment preconditions declared — proceeding on config values only and say which doc was checked. NEVER invent preconditions to fill the table — why: a fabricated prerequisite blocks a healthy run and trains the user to ignore the gate.
• A precondition you cannot verify by any command or observable is still recorded, marked UNVERIFIABLE, and surfaced to the user — why: an unverifiable prerequisite is a gap in the project's doc, not a reason to skip the gate.

Step 2: System Check + Environment Precondition Gate

If systemCheckCommand exists in config:

Run the system check via Bash:

{systemCheckCommand}

Evaluate output:

• Healthy → proceed to the precondition gate below
• Partially healthy / no containers → display startup instructions to user: > "System not fully ready. To start: run {startupScript} (or follow the guidance above). Wait for all services to be healthy, then re-run /integration-test-verify."

  STOP — do not run tests against an unhealthy system. Results would be unreliable.

If no systemCheckCommand:

• If guidance, reference docs, runScript, or startupScript indicate required local infrastructure/services, STOP and tell the user the project config needs a concrete readiness check before AI verification can run.
• Otherwise, proceed to the precondition gate and explicitly report that no system check was configured.

Precondition gate (BLOCKING — every harvested item, evidence-backed)

A green systemCheckCommand does NOT discharge the Step 1b checklist: it verifies only what the config author thought to encode, while the reference doc is where the project wrote down what the runner silently assumes. Walk the checklist and settle every row.

1. Verify each item against real evidence — a command's actual output, a port/process/container check, a config or env read, a query. NEVER mark an item met by reasoning that it "should" be up.
2. Mark each row MET (with the evidence) · UNMET (with what is missing) · UNVERIFIABLE (no observable exists — surface it).
3. Any UNMET → STOP before the first test command. Report ENVIRONMENT-BLOCKED, name the unmet precondition and the file:line that declares it, and give the user the concrete setup step (startupScript, the doc's setup section, the missing env var). NEVER run the suite anyway — why: a suite run against a half-ready environment reports infrastructure faults as failing tests, which then get "fixed" in the test code.
4. Never fix an environment gap by editing tests. An unmet precondition is a setup action for the user or a project-config gap to report — never a reason to weaken a test, add a skip, or relax a timeout.
5. Emit the settled checklist (rows + statuses + evidence) into the Step 5 report, so the pass/fail result proves the environment was ready when it ran.

All rows MET (or the explicit no preconditions declared record) → proceed to Step 3.

Step 3: Determine Test Projects

Priority order: testProjectPattern (glob auto-discover) > testProjects (explicit list) > git auto-detect (fallback).

If testProjectPattern exists in config:

Discover test projects by running a glob search for the pattern:

# Example (testProjectPattern from project config, e.g. "**/*.IntegrationTests.csproj")
find . -path "{testProjectPattern}" -type f
# or use language-appropriate glob tool

Use all discovered .csproj files (or equivalent) as the test project list. Exclude any paths outside the pattern scope.

If no testProjectPattern but testProjects list exists:

Use the explicit list from config directly.

If neither exists — auto-detect from git:

# Auto-detect changed test projects
git diff --name-only HEAD | grep -i "IntegrationTest" | sed 's|/[^/]*$||' | sort -u

If auto-detect finds nothing (no uncommitted test changes), ask user: "No changed test files detected. Run all test projects or skip?"

Filter rule: Only run projects relevant to the current change. If user explicitly asks to run all → run all discovered/configured projects.

Step 3b: Test Architecture Contract Scope (before Step 4)

Before the first test command, record the applicable tier matrix and the execution evidence the report must carry:

• Use only commands discoverable in docs/project-config.json, the named reference docs, or existing runner scripts. If a focused/partial command or simple/Windows entry point is not configured, record N/A — <evidence>; do not invent a filter, browser stack, or .cmd wrapper.
• When a focused/partial scope is applicable, execute it and capture its exact Passed/Failed/Skipped counts and process exit status. Verify that an invalid or zero-match selection fails or follows the runner's documented non-green behavior; a zero-match run is never a passing result.
• Record the unique run identity/data suffix, supported public-path setup, realistic data, idempotent count-before-create reference setup, intentional keyed/additive persistence, and the isolation boundary for parallel workers. These fields supplement—not replace—the environment checklist and real-DI/use-case gates.

Step 4: Run Tests

Run this step only after Step 2 passed — system healthy AND every harvested precondition settled MET — or the config/reference docs explicitly state no external system is required.

Execute using quickRunCommand from config. When a focused/partial scope is applicable, run it first and record its exact result; it is diagnostic and never substitutes for the full scope. Then run each relevant suite/project 2 consecutive times without resetting data.

Two-run idempotency gate: If any run fails, verification fails. Fix the root cause, then restart the 2-run sequence from run 1. If a test is red in one run and green in the other, it is INTERMITTENT — adjudicate the cause per Intermittent (flaky) failure adjudication and record the verdict BEFORE changing anything.

Example for a configured integration-test suite:

# Run each test project individually for clear per-project results
{quickRunCommand} {testProject1}
{quickRunCommand} {testProject2}
# ...

Or run all at once using the solution filter if supported:

{quickRunCommand} --filter "Category=integration"

Capture output for every run: record the scope, command, process exit status, and exact Passed, Failed, and Skipped counts, plus failing names. Note: skipped tests marked with the configured framework's skip annotation are expected and not a failure.

Parallel execution across multiple test projects (sub-agent fan-out)

AI agent note: When the determined set (Step 3) has many independent test projects, do NOT run them one-by-one in the foreground — fan out one integration-tester sub-agent per project (or per balanced group of projects) in a single message so they run concurrently, then advance only after EVERY sub-agent returns (all-return barrier). This collapses wall-clock from sum-of-suites to slowest-single-suite.

Apply this only when it is actually safe and worthwhile:

• Threshold. Skip the fan-out for 1–2 small projects (orchestration overhead outweighs the gain); use it once there are several projects or any long-running suite.
• Isolation is mandatory. Parallel suites MUST NOT share mutable state. Fan out only when each project targets its own isolated DB/schema/container/namespace (or the project config / reference docs confirm per-suite isolation). If suites share one database, concurrent runs cross-contaminate state and silently break the "2 consecutive green runs without DB reset" guarantee → run those sequentially instead. When unsure, ask the user or default to sequential.
• Each sub-agent owns the full gate for its assignment. Every sub-agent runs its project(s) through the complete 2-consecutive-green-runs-without-DB-reset sequence, captures real runner output (Passed/Failed/Skipped counts + failing names), and returns that evidence — partial or single-run results are not acceptable.
• Each sub-agent inherits this same discipline. No weakened assertions, no skip annotations, no domain-data hacks; on failure it diagnoses test-bug vs service-bug at the root layer (per the On Test Failure Protocol).
• Barrier + aggregate. Wait for all sub-agents, then merge their per-project tables into the single Step 5 report. Any one project failing its 2-run gate fails the overall verification.

# Conceptual fan-out (one sub-agent per project / balanced group), launched together:
integration-tester → {testProject1}  → 2-run gate → returns counts + failing names
integration-tester → {testProject2}  → 2-run gate → returns counts + failing names
integration-tester → {testProject3}  → 2-run gate → returns counts + failing names
# ... barrier: aggregate all returns into Step 5 report

Step 5: Report Results

After all tests complete, report:

### Integration Test Verify Results

**Run command:** {quickRunCommand}
**Projects tested:** {N}
**Focused/partial scope:** {scope and command, exact counts + exit status, or `N/A — evidence`}
**Repeatability gate:** 2 consecutive runs without DB reset
**Environment preconditions:** {M} harvested from {referenceDoc} — all MET (or: none declared)

| Project | Run | Passed | Failed | Skipped |
|---------|-----|--------|--------|---------|
| {Project1} | 1 | X | 0 | Y |
| {Project1} | 2 | X | 0 | Y |

**Total:** {total_passed} passed, {total_failed} failed, {total_skipped} skipped (expected skip annotations)

Status: ✅ ALL PASS | ❌ {N} FAILURES

On failure:

1. List each failing test name + failure message
2. Diagnose: test bug (wrong assertion setup) or service bug (handler actually broken)?
3. If test bug → fix in the test file (do NOT weaken assertions — fix setup/data)
4. If service bug → report as finding, do NOT silently fix without telling user
5. After fixing → re-run the full 2-run verify sequence
6. RECOMMEND /workflow-integration-test-green to the user whenever this run ends with ANY failure. This skill reports a snapshot; it does not own convergence. That workflow runs the loop that clears the suite — each round re-verifies, adjudicates the fault with /debug-investigate + /integration-test-review, fixes at the owning layer, code-reviews the round's fix diff, and re-verifies from a FRESH full run until the whole suite passes its 2-run gate. Surface it as the recommended next step (see Next Steps) rather than hand-carrying failures one by one.
   • EXCEPTION — do NOT recommend it when this run IS a round of that loop (invoked by integration-test-verify-loop or inside workflow-integration-test-green). Return the counts + failing names to the caller instead. — why: the loop already owns convergence; recommending it from inside itself is circular and would restart the very loop that is running.

Goal Contract evidence (after verify run): Resolve the active Goal Contract per the goal-contract-satisfaction-loop protocol (active plan goal.md → plans/goals/{YYMMDD-HHmm}-{slug}/goal.md). When one exists, append the verification evidence to the goal file's Iteration Log — run command, per-run pass/fail counts, report path — mapped to the saved success criteria these tests verify, and update the matching Goal Satisfaction matrix rows (PASS on 2/2 green, FAIL with the failing-test list, BLOCKED with a user-facing reason). Record No active goal — results reported inline only. when none exists. Never copy raw sensitive fixture data into the goal file.

Fallback Mode (No Project Config)

When docs/project-config.json has no integrationTestVerify section:

1. Detect project type from root files:

   • *.sln or *.csproj → dotnet test
   • package.json → npm test or npx jest
   • pytest.ini / setup.py / pyproject.toml → pytest
   • go.mod → go test ./...

2. Auto-detect changed test files from git:

   git diff --name-only HEAD
   

3. Run detected command on changed test projects.

4. Report results and recommend: "Add integrationTestVerify to docs/project-config.json for project-specific run guidance."

CI-Style Full Run (Reference)

When runScript is configured, reference it for the full CI-style run (not run by AI directly — Windows.cmd scripts and CI runners require user/pipeline execution):

"For a full CI-style run including Docker orchestration and health polling, execute: {runScript}"

This script typically: creates networks → removes stale containers → builds images → starts infrastructure (wait healthy) → starts APIs (wait healthy) → runs all tests.

On Test Failure Protocol

NEVER do these to make failures go away:

• ❌ Remove or weaken assertions
• ❌ Add skip annotations to hide failures
• ❌ Create or mutate domain data through repositories to bypass real use-case paths
• ❌ Mark passing by ignoring error output
• ❌ Report "all passed" without showing actual runner output
• ❌ Widen an assertion timeout, add a retry around a failing assertion, or mark a test flaky-and-skipped to make an intermittent failure go away

DO this instead:

1. Read the failing test method
2. Read the handler/service the test targets
3. Identify: is the assertion wrong, or is the code wrong?
4. Fix at the root cause layer; use real use cases or valid seeded fixtures for data setup
5. Re-run to confirm green
6. If step 3 found the CODE was wrong (SOURCE-WRONG) and your fix changed production/source code, route that changed source into a fresh /changes-review (or emit a HIGH finding requiring it) BEFORE declaring the 2-run green PASS — a source fix that greens a test must not ship un-code-reviewed. (In workflow-feature/workflow-bugfix the downstream workflow-review-changes step already covers this; the route matters for standalone runs.)

If a test fails because the system is unavailable → report as "system not ready" and reference startupScript / runScript. Never change the test.

Intermittent (flaky) failure adjudication — verdict BEFORE any change

A test that is red in one run of the 2-run gate and green in another has NOT told you what is wrong. Emit a written verdict, with evidence, BEFORE editing test code, production code, or any timeout. An unadjudicated flake gets "fixed" by whatever is nearest — which is almost always the assertion.

Classify the cause into exactly one of three:

Rules:

1. Verdict first, change second. Record Flake verdict: (a) | (b) | (c) — {evidence} in the Step 5 report before any edit. "Probably flaky" is not a verdict.
2. Reproduce before concluding. Re-run the failing test repeatedly (it is a fast local test — see the 60s cap) so the intermittency is characterized, not assumed. State the observed ratio.
3. NEVER resolve a flake by widening a timeout, adding a retry, or skipping. Those hide all three causes equally and destroy the signal.
4. Do not file (c) until (a) and (b) are ruled out with evidence. Reporting a test-fidelity defect as a product defect burns hours and erodes trust in the suite.
5. Any resolution restarts the 2-run gate from run 1. An intermittent test is not verified until it is green twice consecutively without a DB reset.

Workflow Recommendation

MANDATORY IMPORTANT MUST ATTENTION — NO EXCEPTIONS: If you are NOT already in a workflow, you MUST ATTENTION use AskUserQuestion to ask the user. Do NOT judge task complexity or decide this is "simple enough to skip" — the user decides whether to use a workflow, not you:

1. Activate workflow-write-integration-test workflow (Recommended) — investigate → spec-tests → why-review → artifact-review --type=spec-tests → integration-test → integration-test-review → integration-test-verify → spec-tests [direction=sync] → docs-update → workflow-end → watzup
2. Execute /integration-test-verify directly — run this skill standalone

Next Steps

MANDATORY IMPORTANT MUST ATTENTION — NO EXCEPTIONS after completing this skill, you MUST ATTENTION use AskUserQuestion to present these options. Do NOT skip because the task seems "simple" or "obvious" — the user decides:

Any failures in this run → /workflow-integration-test-green is the RECOMMENDED first option (list it first), because it owns the converge-to-green loop this skill deliberately does not. All green → lead with /workflow-review-changes as before.

• "/workflow-integration-test-green (Recommended when ANY test failed)" — Drive the whole suite to green: verify → adjudicate the fault → fix at the owning layer → review the fix diff → fresh re-verify, looping until the 2-run gate passes. Omit this option when this run was itself a round of that loop, or when the suite is fully green.
• "/workflow-review-changes (Recommended when all green)" — Review all changes before committing
• "/integration-test-review" — Review the failing tests only (report-only fault opinion), without entering the convergence loop
• "/docs-update" — Update documentation if test counts changed
• "Skip, continue manually" — user decides

[IMPORTANT] Use TaskCreate to break ALL work into small tasks BEFORE starting. A verify step that does not actually run tests 2 consecutive times is not repeatability verification. It is theater. Read project config FIRST to understand how to run tests for this specific project.

Source/test drift check. For coding, fix, debug, investigation, test, or review work: when source behavior changes, inspect affected unit/integration/E2E tests and decide from evidence whether tests should change to match intended behavior or the source change is an unintended bug to fix. Do not write tests for migration code; schema/data migrations are one-time execution paths, not core application logic.

Test-Failure Fault Adjudication — When a test fails (or you are debugging or fixing a failure), the job is to determine who is at fault — the source code or the test code. Getting that verdict right matters more than turning the suite green. Binds every debug / fix / test skill identically.

1. Provisional verdict before touching either side. Classify the observed evidence as SOURCE-WRONG, TEST-WRONG, TEST-NOT-OPTIMAL, ENVIRONMENT-BLOCKED, or AMBIGUOUS; then /debug-investigate and trace end-to-start before editing. A green-again suite is NOT the goal.
2. Triangulate against the spec AND the source. If a governing Feature Spec covers the behavior (e.g. docs/specs/** — §3 ACs / §4 BRs / §5 invariants / §8 TCs), it is the tiebreaker for intended behavior — compare BOTH the production source and the failing test against it. With no spec, the documented intent / acceptance criteria / caller contract is the reference. Decide from this evidence whether the SOURCE is wrong or the TEST is wrong.
3. Classify who is at fault, then fix the wrong side at its root:
   • SOURCE-WRONG — production code violates the spec's intended behavior or a clear invariant → fix the source at the owning layer; keep or strengthen the test that caught it.
   • TEST-WRONG — the test encodes a stale or incorrect assertion, setup, or expectation that contradicts intended behavior → fix the test at its root. NEVER weaken an assertion, add a skip, or relax a timeout to force green.
   • TEST-NOT-OPTIMAL — intended behavior is valid but the test seam, timing, or assertion signal is fragile → improve the test without weakening the invariant.
   • ENVIRONMENT-BLOCKED — infrastructure or external state prevents a source/test verdict → preserve diagnostics and stop mutation until the environment is healthy.
   • AMBIGUOUS — evidence or intended behavior does not safely select an owner → ask the user or canonical owner before editing.
   • NEVER change a test to match broken source, and NEVER change source to satisfy a broken test. (Migration code excluded — schema/data migrations are one-time execution paths, not core application logic.)
4. Ask the user when intended behavior is unclear. If no spec covers the behavior, the spec is silent, or the spec is ambiguous about which side is correct, STOP and AskUserQuestion (or consult the canonical spec owner) before editing either side — never silently pick source or test just to make the suite pass.

Reconcile to intended behavior, never to whichever side currently passes — green can encode the very bug.

Read-only/report-only role boundary: when this block is carried by a report-only role (code-reviewer, quality-gate-review, spec-compliance-reviewer, tester, and any other agent whose definition declares it never edits source), "fix the wrong side" means RETURN the adjudicated verdict and the proposed repair to the parent — do not modify source, tests, generated carriers, or user data. The adjudication is the deliverable; the edit is the caller's. Without this sentence the block's step-3 imperatives read as write authority and directly contradict those agents' own declarations (e.g. tester.md "NEVER implement fixes"), which is the sibling SYNC:double-round-trip-review boundary applied to the same class of carrier.

Spec ↔ Tests ↔ Code Triangulation — The unit of review is the WHOLE PACKAGE (spec + tests + code), not the diff alone. Load all three faces together and reason mutual-consistency FIRST, before any isolated per-file check.

1. Locate all three faces for the changed behavior: the governing Feature Spec section(s) (§3 ACs / §4 BRs / §8 TCs), the tests that guard it, and the production code. A missing face is a finding (SPEC-GAP / TEST-GAP / DEAD-SPEC).
2. Triangulate pairwise — classify which face is wrong on every disagreement:
   • code vs spec → CODE-EXTRA / SPEC-STALE / CODE-WRONG (a [HARD] §4 rule or §5 invariant with no enforcing path is CODE-WRONG).
   • tests vs spec → TEST-GAP / SPEC-SILENT.
   • tests vs code → TEST-GAP / WEAK-TEST (a test that survives a deliberately broken invariant).
3. Capture hidden rules — an invariant the code enforces but the spec never states (SPEC-SILENT) is surfaced as a finding, added into §3/§4/§8, and guarded with a test: the enrichment loop, never a silent pass.
4. Re-review after enrichment — when triangulation adds spec content or a test, re-review the package against the enriched spec; converge only when a full pass surfaces no new disagreement.

NEVER mark PASS while any face disagrees without a logged finding. The diff is the entry point; the package is the unit of judgment.

Spec drift adjudication (code-wrong vs spec-stale). Whenever changed behavior diverges from a canonical Feature Spec (business rule, acceptance criterion, flow, state transition, or §8 TC under docs/specs/), you MUST NOT silently pick a side. Adjudicate per shared/sdd-artifact-contract.md → Drift Gates:

1. Detect — compare the change against the spec's documented intent. No divergence → record Spec in sync and move on.
2. Classify the divergence:
   • CODE-WRONG — the spec correctly states intended behavior and the change violates it → BLOCKING finding; fix the code/test against intended behavior (write/adjust a regression TC first).
   • SPEC-STALE — the change is the new intended behavior and the spec now documents the old/wrong behavior → update the spec FIRST via /spec [mode=update], then sync /spec [mode=tests] + /spec [mode=sync].
   • AMBIGUOUS — intended behavior is unclear → AskUserQuestion (or the canonical spec owner) before editing either side.
   • SPEC-SILENT — the code correctly enforces an invariant/behavior that NO canonical spec artifact (§3 AC, §4 BR, §5 invariant, §8 TC) states → not drift but an UNWRITTEN rule discovered by review. ENRICH the spec via the Invariant Harvest pass (/spec [mode=sync] direction=harvest → spec/references/sync.md): prove it is always-true (≥2 enforcement points or a rejecting guard), express it as

…(truncated)