Fan-out deviations d1-d3: colleague dropped from implementer/reviewer roles; t72/t73 reduced scope; strict PR ordering

[OriNachum]

Three departures from the gate-2 implementation split plan approved for the
guarded-local-operations-plane fan-out. All three are recorded in devague's
append-only deviation ledger as d1–d3 (devague deviate --list), currently
proposed and awaiting operator --confirm. This issue is the human-readable
record.

d1 — colleague dropped from the implementer and reviewer roles

Classification: needs-follow-up

The approved split assigned t73, t75, t81, t82 and t83 to
ask-colleague write --apply, and put ask-colleague review on every task
diff before merge.

Two consecutive colleague drives on well-scoped read-only tasks both failed
identically:

Flight	Verb	Status	Steps
923ceb0bd061	explore — audit the release pipeline	incomplete	0
b507f26c5c80	review — second opinion on the t71 diff	incomplete	0

In both, the drive ended without calling finish, having completed zero
steps. The local vllm-openai / Qwen3.6-27B-Text-NVFP4-MTP backend emitted
a tool call as literal assistant text rather than a structured call:

923ceb0bd061:  <read_file path=".github/workflows/publish.yml">
b507f26c5c80:  <tool_call>
               run_command:

Worth flagging for whoever chases the root cause: colleague doctor --probe
reports tool_calling: tool-calling round-trip OK ... (server emitted a tool_call). The probe passes while the drive path fails, so the probe is not
representative and cannot be used as a readiness check for ask-colleague.

Decision. A backend that completes zero steps on a read-only audit cannot be
trusted to implement a CI gate or to review a security-relevant diff. Claude
subagents implement; independent review comes from SonarCloud and Qodo on each
PR, both of which are posting real results (PR #3: Sonar Quality Gate OK with 0
issues and 0 hotspots; Qodo 0 bugs / 0 rule violations / 0 requirement gaps).

Both runs were graded 1/5 via ask-colleague feedback so the ROI loop
carries the signal.

Follow-up: the root cause is colleague-side, not shell-cli-side. It should
be filed upstream on agentculture/colleague separately — this issue only
records the shell-cli-side consequence.

d2 — t72 and t73 start from partially-complete work

Classification: acceptable

The plan was authored after the /scope → /think → /challenge →
/spec-to-plan arc had already produced two of its own deliverables as spec
evidence: the CLAUDE.md operations-plane rewrite (t72) and the pinned AST
inventory scanner scripts/colleague_inventory.py (t73).

Treating those tasks as greenfield would mean deleting and re-authoring
committed-quality work to satisfy the plan's narrative.

Decision. Each task is reduced to its remaining delta:

• t72 — post the six-part Milestone 0/1 plan on Build brief: shell-cli — the guarded local operations plane for AI agents #1, align
  AGENTS.colleague.md and README.md, document the WebGlass peer seam, and
  commit the devague artifact trail. The CLAUDE.md rewrite rides along as
  already-authored.
• t73 — wire scripts/colleague_inventory.py --check into tests.yml as
  a known-debt gate publishing debt_remaining. The scanner itself is already
  written and pinned to colleague SHA 28fee29.

d3 — PR ordering forced to strict sequence

Classification: acceptable

publish.yml triggers on the pyproject.toml path, and the repo rule is that
every PR bumps the version. Therefore every merge publishes to PyPI, which
is append-only.

The plan's wave 1 would have run t72 and t73 in parallel. But any merge
landing before t71 would publish an unhardened release — one gated on pytest
alone, with lint, bandit, markdownlint and the teken rubric gate all outside
the dependency chain.

Decision. t71 merges strictly first and alone (PR #3), then t72, then
t73. This narrows realised parallelism at the start of the run, but it is
required by t71's own acceptance criterion that it merge first — and the
alternative is a permanent bad artifact on an append-only index.

Not a deviation, but worth recording

devex pr open --body-file - raises an unhandled FileNotFoundError traceback
instead of reading stdin (devex/commands/pr/scripts/open_.py:22). The cicd
SKILL.md documents "body via --body-file PATH or stdin". This also violates
the AgentCulture no-tracebacks convention. Worked around by writing the body to
a temp file; belongs upstream on agentculture/devex.

• shell-cli (Claude)