PlantAI-dev/.superpowers/sdd/task-3-review-package.md

Task 3 review package

Scope and baselines

• Brief: .superpowers/sdd/task-3-brief.md
• Implementer report: .superpowers/sdd/task-3-report.md
• Production baseline/current: /tmp/ppi-id-resolution-task3-baseline/run.py → skills/ppi/run.py
• Backend baseline/current: /tmp/ppi-id-resolution-task3-baseline/pipeline_backend.py → apps/web/pipeline_backend.py
• Existing policy-test baseline/current: /tmp/ppi-id-resolution-task3-baseline/test_ppi_string_policy.py → tests/unit/test_ppi_string_policy.py
• New production file: gfa_core/string_rate_gate.py
• New focused test file: tests/unit/test_ppi_id_resolution.py
• Parent-authorized policy production expansion: gfa_core/ppi_string_policy.py

This workspace has no functional Git repository. Reviewers must use diff -u on baseline/current pairs; for new files, complete-file inspection equals the full patch.

TDD and implementation evidence

• Initial RED: 27 expected failures for absent interfaces/behavior.
• Internal-review integration RED: 2 failures showing production run() was not wired and relationship provenance was absent.
• GREEN after integration fix: 43 focused tests passed.
• Rejected-main-review RED: 34 failed / 17 passed across 51 selected adversarial cases before production corrections.
• Additional stable-authority RED: 2 failed / 9 passed before rejecting double-slash and empty-label pseudo-subdomain addresses.
• Stale policy-test compatibility evidence: 1 failed / 84 passed after the production fail-open path was removed. The parent then authorized migrating only this test to the explicit fake-client API; no production fallback was restored.
• Preferred-name whitespace RED: 1 failed / 13 passed, followed by strict non-whitespace validation.
• Fresh-review RED: 3 failed / 14 passed for empty/comment-only supplied Ortholog mode and whitespace-only stringId; corrected subset is 17/17 green.
• Authoritative re-review RED: 22 failed / 2 passed across 24 redirect/identity/species cases; corrected subset is 24/24 green.
• Backend stale-fake RED: 2 failed / 24 passed; the two parent-authorized image fakes now explicitly assert allow_redirects is False, and backend selection is 26/26 green.
• Final-review RED: scientific/image 6 failed / 1 passed and backend authoritative selection 1 failed; corrected targeted groups are 7/7 and 1/1 green.
• Current focused suite: 123 passed.
• Combined regression: 167 passed.
• Relevant backend image/PPI selection: 26 passed.
• py_compile: exit 0.
• The earlier internal re-review PASS is superseded by the rejected main reviews. Fresh review is required.
• Post-correction internal re-review: PASS, no remaining findings; focused rerun 91 passed. This is evidence for, not a replacement for, the main review gate.
• Latest redirect/identity/species internal re-review: PASS, no Critical/Important/Minor findings; reviewer freshly ran focused 116 passed and backend selection 26 passed. This remains evidence for, not a replacement for, the main review gate.
• Final submitted-set/backend/provenance/image internal re-review: PASS, no Critical/Important/Minor findings; reviewer freshly ran focused 123 passed and backend selection 27 passed. This remains evidence for, not a replacement for, the main review gate.

Authorized scope expansion

The parent explicitly authorized modifying only the stale legacy-interface test in tests/unit/test_ppi_string_policy.py. It now injects a complete fake STRING mapping/network client and verifies the same OSA normalization policy through the deterministic resolver. Production code no longer introspects analyze_network signatures or silently selects a legacy path.

The parent later authorized gfa_core/ppi_string_policy.py plus its focused invariant so every declared canonical STRING species code resolves to itself. The parent also authorized changing only the two backend image fake signatures to require/assert allow_redirects=False; no production compatibility fallback was added.

The parent finally authorized the backend authoritative PPI skill-selection branch and its focused test solely to remove apps/cli/run_ppi_v2.py as a second scientific implementation. The same two image positive fakes now expose required status_code=200 and url=request_url; production has no response-shape downgrade.

The internal review is not a substitute for fresh independent verification, anti-pattern review, and spec/code-quality review.