# Pipeline incident history

Proposed companion to skill 6.59.2. These dated excerpts are preserved verbatim from 6.59.1; they are explanatory records, not replacement procedure.

## packet-replay

**Why replay is separate from Step 4b.** 4b re-derives the *claim* from the REQs and
the repository; historically it was not handed the *packet*, so a fabricated transcript passed an
adversary that never looks at it. Observed 2026-09-02 on OBPI-0.35.0-04: a `$` block
rendered `gz covers --json` output with keys the command does not emit (`obpi_id`,
`coverage_pct`) around figures that were themselves correct — the numbers came from
the dispatch prompt and the *evidence was constructed around them*. It was caught only
because a human happened to re-run the commands.

## plugin-dispatch

> **Measured cost of one hand-rolled run (2026-08-25, OBPI-0.35.0-02):** ~15 minutes
> wedged at 0.07s CPU because `codex exec` blocked on an unredirected stdin — a state
> `codex:setup` reports as `ready: true`; then a 500KB undifferentiated blob that had to
> be `sed`-sliced to find the verdict; then a re-run **refused outright** by an upstream
> cyber filter (*"This content was flagged for possible cybersecurity risk"*) because a
> hand-written refute prompt named Unicode bypass techniques. The plugin path, launched
> against the identical work, streamed structured findings with severity and confidence
> and surfaced a **high**-severity defect the hand-rolled run had missed entirely.

## blocked-state

**Measured cost of not having this** (`OBPI-0.35.0-02`, 2026-08-25/26): 21
`red_receipt_emitted`, 10 `task_started`, **zero** `task_completed`, four
`pipeline_launched` and three adversary rounds in the 24 hours after the brief
became structurally uncompletable. Four agents each re-derived that a human was
needed; none could record it, so each kept working the surrounding surface.

## repeated-root

 Measured: rounds 2, 3 and 4 each patched a different surfacing of one root cause — provenance inferred from a witness's self-consistent claims rather than chained to prior ledger state — at roughly 3h per cycle; the operator ruled the design in a single exchange and it closed in one pass. Round 4's fix also INTRODUCED round 5's critical, which is the signature of patching a surfacing rather than the design.

## unbounded-threat-model

 Measured on OBPI-0.35.0-04: five rounds, 53 minutes of adversary compute across a 12.5-hour wall clock (7%); the rest was fix cycles. Rounds 4 and 5 spent ~9 hours hardening attacks whose reproduction required appending arbitrary rows to `.gzkit/ledger.jsonl` — strictly inside a residual the operator had already accepted for `.gzkit/ownership/`, the same directory and the same access.

## reviewer-execution-gaps

         Measured 2026-09-02 on OBPI-0.35.0-04: a reviewer asked to re-derive a byte span and
         re-run a behave selection could do neither, reported both honestly as `info` findings,
         and returned **CONCERNS** — every finding about its own coverage, none about the code.
         Re-derived by the orchestrator, both checks passed.
