# Feature 007 — Intelligence Pattern Ports: Reviewer Focus

Companion to [`full-codebase-review-prompt-2026-06-17.md`](./full-codebase-review-prompt-2026-06-17.md) + [`agent-review-plan-2026-06-17.md`](./agent-review-plan-2026-06-17.md). 007 merged into `main` after those were written; review it with the same finding format + rigor. Spec: `specs/007-intelligence-pattern-ports/`. Source areas: `src/protocol/{format,edit_tools,edit_plan,prompts,tools,smart_query}.rs`, `src/sidecar/handlers.rs`, `src/stel/{planner,...}.rs`.

**007 = 4 ports + impact-intent + edit_plan co-change.** Author-supplied focus below; the `[FIXED]` / `[OPEN]` tags say what's already adversarially handled (don't re-litigate the fix — but DO challenge whether it's complete) vs. a live flag.

## Cross-cutting invariants (verify hold across all 5 ports)
- **No second index** — only `LiveIndex` + `GitTemporalIndex` (ArcSwap). No port may build/scan a third index.
- **Embed isolation** — all of this is `server`-gated; `cargo check --no-default-features --features embed` stays clean.
- **Transport parity** — logic lives in shared formatters → stdio + `/mcp` identical. No fork.
- **Determinism** — every ranked/ordered output is deterministic (stable tie-breaks), not hash-order/time-dependent.

## 1. Impact footer — `format.rs::{edit_impact_summary,impact_footer}`, `edit_tools.rs::append_impact_footer` (+7 inner-handler wirings)
- **Success-only:** footer appears ONLY on *applied* edits — never on `Err` arms, `AlreadyApplied`, or dry-run. Appended before `complete_mutation_replay`; batch tools only on the `Ok` arm. → trace every edit handler, confirm no footer on a failed/no-op/dry-run path.
- **[FIXED — was the 1 Major: classifier-sentinel leak]** The 3 `_tool` wrappers re-run `classify_edit_output` over the **full body including the footer**. `FOOTER_SENTINEL_SUBSTRINGS` elides partner paths whose name carries a sentinel (e.g. `src/unavailable.rs`). **Reviewer must verify this filter stays in sync with `classify_edit_output`'s `.contains` set** — adding a new sentinel there *without* updating `FOOTER_SENTINEL_SUBSTRINGS` re-opens the leak. Check the regression test pins both sides.
- **Lock soundness:** holds the `index.read()` guard AND calls lock-free `git_temporal()` (separate ArcSwap) → confirm no deadlock / no double-lock; paths are forward-slash-normalized before the temporal lookup (verify Windows paths can't miss).

## 2. Orientation doctrine — `prompts.rs::{build_onboard,build_architecture_map}_instructions`, `tools.rs` get_repo_map compact footer
- Map-body doctrine lives in the **get_repo_map compact footer** (covers both the tool and the `symforge://repo/map` resource); `resources.rs` only routes. → confirm doctrine isn't duplicated/forked between tool + resource.
- Placed **after** the budgeted body (so `build_with_budget` truncation can't eat it). Pinned by `test_read_static_repo_map_resource`. → verify the doctrine survives a budget-truncated body.

## 3. Ranked compact map — `sidecar/handlers.rs::repo_map_text` ("Key types" ranking + `(→N)`)
- **HARD: `full`/`tree` output MUST be byte-unchanged** (`capture_repo_outline_view`/`repo_outline_view`/`file_tree_view` untouched). → diff these against pre-007; any drift is a regression.
- Ranking order deterministic (deps desc, churn desc, path asc + tie-breaks). **Bounded cost — no O(files²)** on large repos. Frecency-neutral (ranking must not read/bump frecency).

## 4. STEL find fusion — `planner.rs::{find_fusion_steps,route_find}`, `smart_query.rs`, `tools.rs` anchor injection + union tolerance in `symforge_stel_handler`
- **No new public tool** — routes only `search_files`/`search_text`. Confirm no tool surface change.
- **[HARD invariant] Frecency: find NEVER bumps frecency** — verify the fusion path never reaches `get_symbol`/`get_file_context` (the commitment tools that bump). `*_does_not_bump` test pins it; confirm it actually exercises the fusion route.
- Golden routes unchanged. **Union tolerance is scoped to find-fusion plans only** — dependent/chained plans must stay fail-fast (a partial failure there must NOT be tolerated). → verify the tolerance can't leak into other plan types.
- **[OPEN — minor]** both-surfaces-empty fusion classifies `Found` (not `NotFound`). Fair flag — assess whether an empty union should be `NotFound`.

## 5. Impact intent + edit_plan — `edit_plan.rs::plan_edit`, `tools.rs::append_impact_intent_cochanges`
- `plan_edit`'s signature **gained a temporal param** → verify ALL callers updated (no stale call site; no default that silently disables it).
- **Graceful omission** when `GitTemporalIndex` is not `Ready` — no placeholder/error/panic, just omit the co-change intent. → test the not-Ready path.
- Reuses `git_temporal` (no second index) — confirm.

## Already adversarially reviewed (don't re-find, do challenge for completeness)
- The footer-sentinel leak (1 Major) → fixed + regression test (see §1). Challenge: is the sentinel-sync guard airtight, or still a footgun?
- Full gate was green pre-merge. The only open item is the §4 both-empty `Found` classification (minor).
