- cloud/audit_sampling.py (pure, stdlib): mandatory sampling (1.0)
for rebuild cases and for third-failure near-complete cases whose
continuation round still failed; random sampling for the rest
(normal 0.10, critical-path 0.50, ceil so small groups are never
rounded to zero, seed required and recorded for reproducibility).
- Wrong-verdict handling: correct the original conclusion and
retrigger the corresponding flow (wrong pushback ->
cancel_pushback_and_rerun_audit; wrong rebuild ->
halt_rebuild_and_restore; wrong pass -> reopen_audit_and_pushback;
unknown original -> escalate_to_human); every result, correct or
corrected, is appended to the audit-of-audit record.
- Golden-set approval checklist: list reviewed, criteria defined,
sample exclusion, approver+timestamp -- all human-confirmed before
approval; sample entries (sample=True or sample- ids) are dropped
and counted, never counted as golden.
- metrics.build_report gains an optional sampling_plan section;
without a plan it states sampling is pending, never implying the
audit was re-examined.
- cloud/arch_conformance.py: contract-version (+1 only, approved
change record), forbidden-directory (own dir only, .. and symlink
escapes resolved), forbidden-import layer bans audited against the
baseline (foundation/execution/driver, server sqlite3 Row adapters
deliberately allowed), G2 frozen-stack swap guard; skill-project
one-call check.
- cloud/metrics.py: first-pass/defect/rework rates over terminal
tasks, unknown rates as None (never 0), #212 dual-column per-task
cost (total None when incomplete), pure feedback rules
(tighten/route-with-extra-audit/recalibrate, auto_apply False),
golden-set gate: unapproved sample set is never decision-ready.
- GET /metrics-report (authenticated, member-scoped, same as
/metrics): attempts/defects are None until an attempt ledger
exists, so rates stay unknown rather than fabricated.
- Tests: 29 arch + 15 metrics + 3 endpoint, each check with
positive and negative cases; repo-level scan pins zero layer
violations on the baseline so a future violation fails CI via the
existing host-verify discover run (no workflow change).
host