The parallel execute path runs no risk check, no risk_surface fire and no status call #204

New issue

Closed

opened 2026-08-16 17:22:22 +00:00 by john · 0 comments

john commented

2026-08-16 17:22:22 +00:00

Owner

The gap, counted

$ grep -c "risk-check" cadence-core/workflows/execute.md          -> 2
$ grep -c "risk-check" cadence-core/references/execute-parallel.md -> 0

execute.md's sequential branch runs risk-check run --phase <N> --plan <k> --base {pre-plan HEAD} --head HEAD, conditionally fires risk_surface on a
non-empty matches OR inconclusive: true, and then requires
risk-check status to answer before the plan may be reported done - explicitly:
"The plan is NOT reported done while that call refuses."

references/execute-parallel.md merges, runs workflow.test_command, fires
diff, and fires phase_diff. It never runs the detector, never fires
risk_surface, and never calls status.

Consequence, scoped honestly

risk_surface is the ONE gate that is blocking at every stakes level. On the
parallel path it does not exist.

At shipped (the default) diff and phase_diff are both off, so eligible
parallel work can reach the merge with no post-code review of any kind.
At critical there is compensating cover: blocking diff per plan and
adjudicated phase_diff on the merged phase. This repository moved to
critical today, so the exposure here is narrower than it was when the review
was written.
The detector RECEIPT is lost at every level. risk-check status is what makes
a range provably judged; without it a parallel plan completes in a state the
sequential path would refuse to report done. The two branches disagree about
what "done" means.

Why it is not a universal bypass

Parallel is opt-in and requires four conditions plus use_worktrees plus a
head fork point. A user who never enables it is unaffected. That is why this
is a wiring gap rather than a hole in the risk gate itself.

The fix shape

The sequential branch's three steps are stated once in execute.md and should be
reachable from both branches rather than restated in execute-parallel.md - the
same "one reader" lesson v3.5.2 just applied to the lease grammar and the text
transport. A copied second sequence is exactly the drift this milestone's theme
is about.

Per-plan placement on the parallel path needs deciding: on each plan's own
committed range before merge, or once on the merged range. The former matches the
sequential semantics; the latter is cheaper and matches phase_diff's framing.

Source: external strict re-review, 2026-08-16 (EXEC-01, Medium, the review's
headline finding). Counts verified here.

## The gap, counted ``` $ grep -c "risk-check" cadence-core/workflows/execute.md -> 2 $ grep -c "risk-check" cadence-core/references/execute-parallel.md -> 0 ``` `execute.md`'s sequential branch runs `risk-check run --phase <N> --plan <k> --base {pre-plan HEAD} --head HEAD`, conditionally fires `risk_surface` on a non-empty `matches` OR `inconclusive: true`, and then requires `risk-check status` to answer before the plan may be reported done - explicitly: "The plan is NOT reported done while that call refuses." `references/execute-parallel.md` merges, runs `workflow.test_command`, fires `diff`, and fires `phase_diff`. It never runs the detector, never fires `risk_surface`, and never calls `status`. ## Consequence, scoped honestly `risk_surface` is the ONE gate that is `blocking` at every stakes level. On the parallel path it does not exist. - At `shipped` (the default) `diff` and `phase_diff` are both `off`, so eligible parallel work can reach the merge with no post-code review of any kind. - At `critical` there is compensating cover: blocking `diff` per plan and adjudicated `phase_diff` on the merged phase. This repository moved to `critical` today, so the exposure here is narrower than it was when the review was written. - The detector RECEIPT is lost at every level. `risk-check status` is what makes a range provably judged; without it a parallel plan completes in a state the sequential path would refuse to report done. The two branches disagree about what "done" means. ## Why it is not a universal bypass Parallel is opt-in and requires four conditions plus `use_worktrees` plus a `head` fork point. A user who never enables it is unaffected. That is why this is a wiring gap rather than a hole in the risk gate itself. ## The fix shape The sequential branch's three steps are stated once in `execute.md` and should be reachable from both branches rather than restated in `execute-parallel.md` - the same "one reader" lesson `v3.5.2` just applied to the lease grammar and the text transport. A copied second sequence is exactly the drift this milestone's theme is about. Per-plan placement on the parallel path needs deciding: on each plan's own committed range before merge, or once on the merged range. The former matches the sequential semantics; the latter is cheaper and matches `phase_diff`'s framing. Source: external strict re-review, 2026-08-16 (EXEC-01, Medium, the review's headline finding). Counts verified here.