Hadúr Dashboard

Lens × Round coverage

Rows are Contract §-sections (windowed to the last 5 rounds); a dark/muted cell is a blind spot, not a "no data" gap.

Sweep three-state model: verified-clean · drift · skipped · candidate — see the Key view.

Signals (§7.3)

S1′

two clean rounds per lens, on the current code (S1′)

S2

every Contract §-section reviewed within the window — no blank rows

S3

no forbidden import aliases / retired names in narrative

S4

every §18 Export row has an owning task

S5

every §18 Import cites the provider's current version + signature

S6

each plan's §-by-§ self-review table is filled

S7

every lens covered with certified provenance — no blank lens rows

Lenses (§7.3.1) — the 13-lens registry

L1 — contract

Does the code match the Contract's §-sections?

L2 — persistence-concurrency

Locks, atomicity, crash consistency, lost updates.

L3 — error-surface

Does failure surface correctly, and does the exit-code gate hold?

L4 — behaviour-idempotency

Trace a user journey end-to-end. Is a re-run idempotent? What does a partial failure leave behind?

L5 — data-correctness

Is what we write semantically right — right parent, right label, right round — not merely written without crashing?

L6 — security-secrets

Can a credential or PII reach a place with a wider audience? Can hostile input from one side corrupt the other?

L7 — operator-experience

Under stress, does the tool tell the truth? Is the documented recovery procedure real?

L8 — test-quality

Would these tests fail if the invariant broke?

L9 — enforcement-integrity

Is the guard/invariant itself sound, complete, and fail-closed — or correct only on the shapes it already knows?

L10 — reachability

Is every declared capability traced to an operator entry point, or is it dead surface?

L11 — performance-resource

Time, memory, file handles, unbounded growth, N+1 work.

L12 — packaging-environment

Does it install, import, and run outside the author's machine?

L13 — free-sweep

Deliberately NOT the lens of the last N rounds (§7.7 tunnel signal).

Drift catalog (§20)

C1-C18

the §20 narrative-drift catalog the sweep greps for

C18

fail-open enumeration — a denylist guard where an unknown construct passes; surfaced as candidates, never 'clean' (§6.5)

Severity

Critical

blocks convergence; Breaker-gated fix + re-review

Major

real defect; blocks a clean round

Minor

should fix; does not block

Nit

polish / preference

Sweep three-state model

verified-clean

checked, no drift — the only state counting toward clean

drift

a real disagreement — blocks (exit 3)

skipped

could not check — never 'clean'; blocks only under --strict

candidate

a C18 fail-open surfacing — a reviewed note, not a safety verdict

Exit codes

0

clean

2

typed error / usage error

3

drift, unacknowledged candidate, or (--strict) a skip