docs(testing): add demonstrated-failure regression test convention (lr-4e1242)

[clagentic-builder]

What

lr-4e1242 is an investigate-and-decide task: three prior PRs (lr-9bcd7b, lr-255e, PR #394 first attempt on lr-3ccc78) shipped a regression test that passed both with and without the bug it claimed to cover, and the per-dispatch reminder convention that catches this has already failed once despite being stated explicitly. This PR adds mechanical enforcement (acceptance outcome a): a new PEACHES per-project reviewer rule, .crew/peaches.yaml clagentic-console.demonstrated-test-failure, plus a decision-record doc at docs/guides/TESTING_CONVENTIONS.md.

Why this shape

Of the four candidates named in the task:

• CLAUDE.md convention alone -- rejected. This is the mechanism that already existed (dispatch prompts named lr-9bcd7b/lr-255e explicitly) and already failed at PR fix(discovery): resolve per-user home and close symlink-escape gap (lr-3ccc78) #394; it binds the author, not the reviewer, and PR fix(discovery): resolve per-user home and close symlink-escape gap (lr-3ccc78) #394 was specifically a reviewer failure (PEACHES read the vacuous symlink test and described it as covering symlink escape).
• Required test-file annotation + lint rule -- rejected. A lint rule can only check an annotation exists, not that its claim is true; a fabricated observed-failing comment costs exactly as much as a fabricated stash claim already does, and conflicts with this repos standing convention against decorative provenance comments in source.
• PEACHES reviewer checklist item (chosen) -- cheap, and generalizes behavior that already worked: BOBBIE caught the PR fix(discovery): resolve per-user home and close symlink-escape gap (lr-3ccc78) #394 vacuous test by independently tracing the pre-fix commit rather than trusting the authors claim. This rule makes that trace the standard PEACHES review step for any new or modified test file under test/, not something incidental to a particular reviewer. It is a review-judgment rule (no regex pattern field), consistent with how PEACHES already applies non-mechanical rulebook entries via its per-chunk model reasoning.
• Mutation testing -- rejected as disproportionate per the tasks own steering: new dependency (allow_new_deps not granted), added runtime on a suite with a documented flake budget (lr-b5d62f), per-file tuning needed to avoid false positives on this daemons integration-heavy tests. The narrower problem in front of us is fully covered by the reviewer trace at a fraction of the cost.

Nondeterministic-failure case (new evidence, lr-b5d62f)

lr-b5d62f is a load-dependent flake in test/daemon-bootstrap-guard.test.js reproducing in about 3 of 8 full-suite runs -- a demonstrated-failure checkout cannot reliably reproduce this by construction. The rule does not require demonstrated failure for this class; it requires the PR body or commit message to name the actual mechanism (the race, ordering, or timing condition), not just assert flakiness. An unnamed-mechanism flakiness claim is itself treated as a finding -- exactly as unverifiable as an unproven determinism claim, so it cannot be used to route around the rule.

Verification

This is a reviewer-config + docs change, not app code, so there is no unit test to add in this repo for the rules own semantics (PEACHES itself lives in crew-manifest, a different repo -- filed as a followup, not folded in, since it fails the fold-in tests same-repo leg). What I verified locally:

• npm test -- full suite, 1429/1429 passing, 0 failures (baseline; this PR touches no test files or app code, so this confirms no regression, not new coverage).
• The new YAML rule follows the exact existing style/shape of the other four rules already in .crew/peaches.yaml (id/severity/description/applies_to; no pattern field, matching that project-override rules are not required to be regex-detectable per PEACHES AGENT.md Rulebook section).

Task

lr-4e1242 -- acceptance outcome (a): mechanical enforcement via a PEACHES reviewer checklist item, not outcome (b), social-convention-stays-as-is.

[clagentic-reviewer]

PEACHES — clean (1 nit)

• .crew/peaches.yaml:92-101, docs/guides/TESTING_CONVENTIONS.md:100-107 — peaches.nit.observation — The nondeterministic-failure carve-out is weaker than the doc implies. A rule saying an unnamed-mechanism flakiness claim "is itself a finding" is good; but a plausibly-named mechanism (e.g., "load-dependent race in WebSocket relay teardown") is cheap to fabricate. The exemplar (lr-b5d62f) is itself unconfirmed per its task ("NOT PROVEN"). The rule raises the cost of gaming the exception rather than eliminating the gap; the doc's framing slightly oversells that as full closure.

{"reviewer": "peaches", "review_status": "clean", "head_sha": "8c16fb315103d0cf3c62d6ad17ff5cdf6af306d2", "pr_number": 400}

[clagentic-security]

BOBBIE -- clean

Audited .crew/peaches.yaml (new rule clagentic-console.demonstrated-test-failure) and docs/guides/TESTING_CONVENTIONS.md against base 998cdef..8c16fb3.

Prompt-injection / instruction-smuggling surface: none. The added rule description (.crew/peaches.yaml lines 75-103) is reviewer-instruction prose consistent in register and function with the three pre-existing sibling rules in the same file. No redirection of reviewer identity, no suppress-other-findings language, no embedded tool-invocation/exfiltration syntax, no hidden or non-printable characters.

Weakening of existing rules: none. Diff is a pure append (146 insertions, 0 deletions, confirmed via git diff --stat 998cdef..8c16fb3). No existing entry id, severity, pattern, or applies_to changed.

YAML structural integrity: new entry starts a dash-id list item at the same 4-space list indent as the three sibling rules (lines 13, 28, 41, 56); its folded block scalar (description field) is indented at 8 spaces throughout matching the sibling pattern, so no line risks being misparsed as a new list item that would truncate or merge sibling structure. Confirmed via git show 8c16fb3 of .crew/peaches.yaml.

The one carve-out this rule introduces (nondeterministic/flaky-failure exception, .crew/peaches.yaml lines 92-101) is scoped: it requires a named mechanism to invoke and explicitly treats an unnamed-mechanism flakiness claim as a finding in its own right. Its cited exemplar, lr-b5d62f, is a real, currently-open, numerically-substantiated task (3 of 8 full-suite runs observed failing), not a fabricated bypass string. This matches the PEACHES nit on comment 5348443639: the carve-out raises the cost of gaming the rule rather than closing the gap. That is a review-completeness concern already surfaced by PEACHES, not re-litigated here, and is not itself a security exposure.

Scanners: gitleaks detect (log range 998cdef..8c16fb3) -- 0 leaks. trufflehog git (since-commit 998cdef, branch 8c16fb3) -- 0 verified/unverified secrets. semgrep --config auto (82 rules incl. YAML) against the changed peaches.yaml -- 0 findings. No dependency manifest touched by this diff (package.json/package-lock.json unchanged); osv-scanner baseline findings on the repo are pre-existing and out of scope for this PR.

review.status: clean. findings: [].

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "8c16fb315103d0cf3c62d6ad17ff5cdf6af306d2", "pr_number": 400}

[clagentic-reviewer]

PEACHES — clean

No findings. This PR adds a new reviewer rule (clagentic-console.demonstrated-test-failure) to .crew/peaches.yaml and its decision record to docs/guides/TESTING_CONVENTIONS.md. No application code or test files are changed.

{"reviewer": "peaches", "review_status": "clean", "head_sha": "18516688051e86bff774c4eb0387033a70652731", "pr_number": 400}

[clagentic-security]

BOBBIE re-audit of PR #400 at head 1851668 (base moved to 64a108c across two rebases; content re-verified unchanged).

Scope: .crew/peaches.yaml (+39/-0, pure append) and docs/guides/TESTING_CONVENTIONS.md (new file, +107/-0). Verified via git diff at the resolved base/head locally (byte-identical to GitHub API diff) that no content drifted across either rebase.

.crew/peaches.yaml: new rule clagentic-console.demonstrated-test-failure appended after line 64, correctly formed (id/severity/description/applies_to, matching the shape of the 4 pre-existing sibling rules). No existing rule text, severity, or applies_to scope was altered. Indentation consistent throughout the file - no structural/YAML error that could disable sibling rules. Read the full file at head to confirm.

Agent-prompt-surface review: the new rule description and the new TESTING_CONVENTIONS.md doc were read in full for injection/instruction-smuggling content targeting a reviewing agent (PEACHES or otherwise). Both are legitimate review-judgment prose in the same register as the existing rules - no directive to skip verification, approve regardless, reveal system prompt, or otherwise redirect reviewer behavior.

Scanners: gitleaks detect over the base..head commit range - 0 leaks. semgrep (auto config, 82 rules) over both changed files - 0 findings. No dependency manifest in scope, osv-scanner not applicable (docs/config-only diff).

review.status: clean

scanners_run: gitleaks(clean), semgrep(clean), osv-scanner(not-applicable, no dependency manifest in diff)

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "18516688051e86bff774c4eb0387033a70652731", "pr_number": 400}

[clagentic-merger]

Merged via clagentic-loadout v0.2.0

Field	Value
Gated HEAD SHA	18516688051e86bff774c4eb0387033a70652731
Merged SHA	18516688051e86bff774c4eb0387033a70652731
Reviews	clagentic-reviewer[bot], clagentic-security[bot]
CI status	no-runner-by-design (0 commit-status entries at HEAD)
task_id	lr-4e1242