docs(policy): decide Ponytail simplicity posture #125

Merged

pdurlej merged 1 commit from codex/ponytail-simplicity-decision into main

2026-06-23 18:47:59 +02:00

codex commented

2026-06-23 18:44:49 +02:00

Collaborator

Issue: #123
Value: risk
Effort: small
Lead time: same-day

Summary

record D25: Ponytail is inspiration/vocabulary only, not a Patchwarden runtime dependency
add an operations decision note for a future default-off simplicity_review reviewer lane
keep the proposed lane advisory-only until dogfood calibration proves low false-positive risk

Verification

PYTHONPATH=src:. python3 -m unittest discover -s tests
PYTHONPATH=src:. python3 -m unittest tests.test_status_html tests.test_cli_status tests.test_docs_module_inventory
git diff --check

Refs #123

Issue: #123 Value: risk Effort: small Lead time: same-day ## Summary - record D25: Ponytail is inspiration/vocabulary only, not a Patchwarden runtime dependency - add an operations decision note for a future default-off `simplicity_review` reviewer lane - keep the proposed lane advisory-only until dogfood calibration proves low false-positive risk ## Verification - `PYTHONPATH=src:. python3 -m unittest discover -s tests` - `PYTHONPATH=src:. python3 -m unittest tests.test_status_html tests.test_cli_status tests.test_docs_module_inventory` - `git diff --check` Refs #123

codex added the

labels

2026-06-23 18:44:49 +02:00

codex added 1 commit

2026-06-23 18:44:50 +02:00

docs: decide ponytail simplicity posture

fallow-py / fallow-py-advisory (pull_request) Successful in 15s

Details

e160a1d871

pdurlej merged commit aea3cc1f37 into main

2026-06-23 18:47:59 +02:00

pdurlej referenced this pull request from a commit

2026-06-23 18:48:00 +02:00

Merge pull request 'docs(policy): decide Ponytail simplicity posture' (#125)

codex referenced this pull request

2026-06-23 18:48:59 +02:00

feat(review): add default-off simplicity_review lane #126

claude commented

2026-06-23 18:51:07 +02:00

Collaborator

🏛️ Architect review (loop) — ✅ endorse; one non-blocking egress note

D25 is well-formed and faithful to the core disciplines:

Protects stdlib-only: explicitly rejects Node/hooks/MCP/package-install for core (Options C/D rejected). ✅
Sensor-not-gate (D20): simplicity_review is default-off, advisory, no approval/merge/blocker authority until 10–20 dogfood PRs prove low false-positive — textbook earn-trust-via-dogfood. ✅
Coheres with existing modules: the dependency_risk_sensor / content_slop_sensor / structural_code_gate delineation is accurate and useful. ✅

One non-blocking note (egress posture vs D23): the example TOML sets cloud_review = "allowed". D23 made cloud-review fail-closed (default forbidden; effective posture re-clamped at runtime for sensitive classes), so this isn't a contradiction — D23's review_run guard remains authoritative downstream. But there's a calibration mismatch: the lane is otherwise maximally cautious (default-off, advisory, no authority until dogfood), yet its egress default is allowed. For consistency with both D23's fail-closed stance and D25's own dogfood-first posture, consider starting the lane at cloud_review = "forbidden" and flipping to allowed only once you've confirmed simplicity diffs are safe to egress — i.e., let egress earn trust the same way authority does. At minimum, a one-line note in the decision doc acknowledging the D23 interaction would stop a future implementer inheriting allowed by template inertia.

Not a blocker — mergeable as-is. The note is about template defaults, not correctness. — claude (architect loop)

## 🏛️ Architect review (loop) — ✅ endorse; one non-blocking egress note D25 is well-formed and faithful to the core disciplines: - **Protects stdlib-only**: explicitly rejects Node/hooks/MCP/package-install for core (Options C/D rejected). ✅ - **Sensor-not-gate (D20)**: `simplicity_review` is default-off, advisory, no approval/merge/blocker authority until 10–20 dogfood PRs prove low false-positive — textbook earn-trust-via-dogfood. ✅ - **Coheres with existing modules**: the `dependency_risk_sensor` / `content_slop_sensor` / `structural_code_gate` delineation is accurate and useful. ✅ **One non-blocking note (egress posture vs D23):** the example TOML sets `cloud_review = "allowed"`. D23 made cloud-review **fail-closed** (default `forbidden`; effective posture re-clamped at runtime for sensitive classes), so this isn't a contradiction — D23's `review_run` guard remains authoritative downstream. But there's a *calibration mismatch*: the lane is otherwise maximally cautious (default-off, advisory, no authority until dogfood), yet its egress default is `allowed`. For consistency with both D23's fail-closed stance and D25's own dogfood-first posture, consider starting the lane at `cloud_review = "forbidden"` and flipping to `allowed` only once you've confirmed simplicity diffs are safe to egress — i.e., let egress earn trust the same way authority does. At minimum, a one-line note in the decision doc acknowledging the D23 interaction would stop a future implementer inheriting `allowed` by template inertia. Not a blocker — mergeable as-is. The note is about template defaults, not correctness. — claude (architect loop)