100%

Walking Skeleton — One Detector End-to-End

Goal

Prove the whole graph-seam pipeline on ONE detector before fanning out. Wire scripts/impl_hygiene_review_runtime/seam_scan.py: run one composed /query-intel query (cross-crate clone-DRY: non-test functions, body span >= 10 lines, >= 2 distinct crates, shared clone_fingerprint), emit a ranked candidate worklist, and route every candidate through the verification-gate primitive that DROPS any candidate lacking a recorded manual code-read confirmation.

  • The clone_fingerprint graph property is produced by intel_repo/neo4j/clone_detect.py (canonical type-1/type-2 clone hash) — the query keys on an existing, populated property.
  • The raw self-join is degenerate: per this section’s intel dossier clone_fingerprint is empty on 13477/35072 symbols and ~1780 symbols share the dominant value 0d2f28268c5b1683, so the composed cypher MUST filter the empty-string and dominant-trivial fingerprints (NON-NEGOTIABLE per the dossier) before it is executable.
  • Recon helpers (scripts/impl_hygiene_review_runtime/recon.py, finding_emit.py) and the scripts/intel-query.sh cypher subcommand already exist; seam_scan.py is absent because it is the deliverable of this section.

Implementation Sketch

  • seam_scan.py composes the cypher via scripts/intel-query.sh cypher, parses rows into Candidate{category, symbols[], file_lines[], evidence}, writes {run_id}/seam-worklist.json.
  • The verification gate is the SOLE Candidate -> Finding transform and refuses emit unless verified: true + a verification_note (file:line + what was checked against real source) is set.
  • Reuse the existing scripts/impl_hygiene_review_runtime/recon.py helper surface; never blindly accept a graph row (per .claude/rules/intelligence.md Graph-First Mandate).

Spec References

.claude/rules/intelligence.md Graph-First Mandate (DISCOVERY only; verify against real code); .claude/rules/script-first.md §4 runtime layout; impl-hygiene.md LEAK:algorithmic-duplication.

Scope Boundary — Skeleton vs. Hardening (vs. s-25d74876)

This section’s verification-gate work item (w-d53f7859) builds the MINIMAL Candidate -> Finding primitive for the ONE walking-skeleton detector: a single drop-unless-verified transform inside seam_scan.py, sufficient to prove the pipeline end-to-end. It is the prototype, not the structural enforcement point.

Section s-25d74876 (work item w-a532fc34, “Enforce drop-unless-verified in the runtime Candidate -> Finding emit path”) is the HARDENING successor: it makes the gate structural and mandatory across ALL detectors in the shared runtime emit path and wires INTEL_BYPASS. s-25d74876 generalizes the primitive prototyped here — the skeleton’s inline gate is folded into the runtime emit path s-25d74876 owns.

The split prevents both sections claiming the SOLE Candidate -> Finding transform: the skeleton owns the one-detector prototype; s-25d74876 owns the all-detector structural gate and consumes the proven primitive this section delivers. Under the v7 linear-route flat-node model the prototype-then-harden ordering is already encoded by section position in the route walk (s-25d74876 follows s-cc269c32) — there is no stored depends_on section-edge field to record (it is retired per .claude/rules/v7-plan-system.md).

Work Items

  • Add seam_scan.py with the cross-crate clone-DRY composed query + Candidate schema
  • Add the verification-gate primitive (Candidate -> Finding; drop-unless-verified) as the skeleton’s inline one-detector prototype — generalized into the structural runtime gate by s-25d74876 (w-a532fc34); this section delivers the prototype the hardening section depends on
  • Add seam-worklist.json schema + next_action-shaped emission for Phase 2/3 consumption
  • pytest: clone-DRY returns >= 1 cross-crate cluster on a fixture AND an unverified candidate is dropped