Part of #195. Blocked on #215 (the role runner).
Today
survey builds a context with gather() — the named --doc files, a tracked-path listing, recent history — makes one model call, and parses a proposal out of the reply.
So the quality of a generated plan is capped by what gather() guessed to include. The model cannot open a file it was not handed, cannot follow a reference it finds, and cannot check a claim it is about to make. Against rdpapp the prompt measured ~12k tokens against a repository of hundreds of files.
Why this is the same defect as the implementer's
A plan is a set of claims about a repository: this work is not done, this file is where it goes, these are the tracked sources. Every one is checkable by looking, and none of them is checked.
The measured consequence is on record. The generated M2 plan named migration-tool/src/db.rs, models.rs and both SQL fixtures — correctly — but its acceptance criterion for T1 was satisfiable by a hand-maintained list, because nothing had looked at what those sources actually contained. The reviewer caught it later, and the brief had to be rewritten by hand to say "parse the CREATE TABLE statements at test time".
A surveyor that can grep writes that criterion itself.
What is wanted
survey calls the role runner with a read-only environment on the repository, and the same termination and bounds every other role gets. It keeps everything else it already does: the harness's own parser is still the gate on the generated plan (--force overrides it and says why), blocking questions are still raised rather than guessed, and --out is still claimed and never clobbered (#191).
Read-only because a surveyor has no business changing the repository it is describing.
Acceptance
Blind spots
- Cost. One call becomes ~30 against a repository the surveyor is free to wander.
survey runs once per project rather than once per item, so the absolute cost is small, but nothing bounds exploration except the step limit.
- Whether a read-only environment is enforceable through
CommandGuard as it stands, or needs a separate mode, has not been checked.
Part of #195. Blocked on #215 (the role runner).
Today
surveybuilds a context withgather()— the named--docfiles, a tracked-path listing, recent history — makes one model call, and parses a proposal out of the reply.So the quality of a generated plan is capped by what
gather()guessed to include. The model cannot open a file it was not handed, cannot follow a reference it finds, and cannot check a claim it is about to make. Against rdpapp the prompt measured ~12k tokens against a repository of hundreds of files.Why this is the same defect as the implementer's
A plan is a set of claims about a repository: this work is not done, this file is where it goes, these are the tracked sources. Every one is checkable by looking, and none of them is checked.
The measured consequence is on record. The generated M2 plan named
migration-tool/src/db.rs,models.rsand both SQL fixtures — correctly — but its acceptance criterion for T1 was satisfiable by a hand-maintained list, because nothing had looked at what those sources actually contained. The reviewer caught it later, and the brief had to be rewritten by hand to say "parse theCREATE TABLEstatements at test time".A surveyor that can
grepwrites that criterion itself.What is wanted
surveycalls the role runner with a read-only environment on the repository, and the same termination and bounds every other role gets. It keeps everything else it already does: the harness's own parser is still the gate on the generated plan (--forceoverrides it and says why), blocking questions are still raised rather than guessed, and--outis still claimed and never clobbered (#191).Read-only because a surveyor has no business changing the repository it is describing.
Acceptance
--docand not in the top-level listing.Blind spots
surveyruns once per project rather than once per item, so the absolute cost is small, but nothing bounds exploration except the step limit.CommandGuardas it stands, or needs a separate mode, has not been checked.