[TheAmericanMaker]

Summary

Closes #143 — as the hybrid the issue and the roadmap converged on, built on today's comparison run rather than on the tool-using sweep the issue was filed for.

The evidence: on this repository, the top twelve findings by severity from a real Broad-Side sweep were two real defects and ten claims a look at the guard, the caller, or the tsconfig dismissed (17% precision). One sync-priced call per finding with read-only tools and the rubric below agreed with a reviewer's ground truth on all twelve, for $0.13.

The feature: codecarto_broadside {action: "verify", top, model?, run_id?, max_cost?} / /codecarto-broadside verify [--top=N] [--model=] [--run=] [--max-cost=].

• Ranks the collected run's defect + security findings most severe first (truncated slices skipped), reads the top N (default 10).
• Per finding: up to 8 calls to read_file (line ranges, 200 max), grep (40 matches max), list_dir, all confined to the repository's readable source files (same listing the lenses scan; credential stores and build output invisible; a path outside the repo is an error the model sees). Then a schema-forced verdict: confirmed (must name the trigger it found), not-a-defect (literally true, nothing reaches the failure), discarded (wrong about the code), unclear.
• The run's model without its :batch suffix unless overridden; reasoning: {effort: "low"}; usage.cost accounted per call.
• max_cost is a running cap (a sync call's cost is known only when it returns): stops before the next finding, reports partial. AbortSignal honoured. A provider error is the finding's verdict, not a throw.
• Writes verified.md + verified.json beside triage.md; records run.verify (merged like the other slots; status prints it). The reading guide now says: read verified.md first.

Live (this repository, through the MCP handler, before merge)

Broad-Side verify — run 2026-09-13T20-00-19-293Z: completed
  12 of 24 verifiable finding(s) read on google/gemini-3.7-flash | cost: $0.1212
  confirmed 1 · not-a-defect 5 · discarded 6 · unclear 0
  ✓ [medium] Pipeline outcome resolved outside status lock @ core/amendment.ts:131 — confirmed
  ✗ [medium] Dangling AbortSignal abort listener if sleep timer expires @ core/broadside.ts:1096-1107 — discarded
  …
  – [medium] Unvalidated flag value indexing in codecarto-library-init @ extensions/codecarto/index.ts:748 — not-a-defect

11/12 agreement with the ground truth recorded before any verifier ran; the twelfth is a silently ignored trailing --namespace that the pass called not-a-defect after reading the caller — the borderline the rubric leaves to the reader.

Tests

tests/broadside-verify.test.mjs (9): ranking and the sync-model mapping; reader confinement (credential store unreadable and invisible to grep, ../absolute paths rejected, line ranges, invalid regex, prefix search, listing); the full pass with a scripted chat endpoint (rubric, low effort, usage accounting, tools, tool result round trip, verified.md/json, run.verify, status line, report); prose → one schema-forced follow-up; an endless tool-caller cut at the budget with a final no-tools call; the running cost cap and abort; a provider error as a verdict; nothing-verifiable and unknown-run refusals; MCP validation + structured content; the Pi command and widget. tests/broadside-flags.test.mjs: --top and the verify action rules. npm test 902/902.

🤖 Generated with Claude Code