GPT Review S190 — P10B-2C-PF-R2 prompt

Date: 2026-04-30
Phase: TAC MVP / P10B / D28
Verdict: APPROVED AFTER SMALL PATCHES

---

1. Overall assessment

Opus prompt is correct in direction and not overly fussy:

• Manifest-first from KB.
• No /tmp dependency as SSOT.
• No SQL execution.
• No PF + Execute combination.
• Checks the previous failure mode: UV description + 20/7 split.
• Uses KB canonical package and SHA/byte verification.

This is acceptable as a file-only PF-R2, provided the patches below are applied.

---

2. Required small patches

Patch 1 — Clarify SSH/DB preflight is deferred, not removed

The prompt says no SSH/no DB connection. This is acceptable for PF-R2 file inspection, but must not weaken the execution gate.

Add near DO NOT RUN SQL:

This PF-R2 is file-only. Fresh SSH VPS/DB identity/collision/triggers preflight is deferred to Execute R2 and remains mandatory before any execution. PF-R2 PASS alone does not authorize execute.

---

Patch 2 — Fix sanitizer order

Current T4 strips comments before masking dollar-quoted bodies. This can be wrong if unit bodies contain SQL comments or comment-like text.

Replace sanitizer guidance with:

First detect paired BODYTAG ranges on raw SQL and mask/replace the body ranges with a placeholder. Only after body masking, strip comments from the outer SQL. Then count INSERT/DELETE/DDL on the masked outer SQL.

The position-based method is still correct, but the order must be body-mask first, comment-strip second.

---

Patch 3 — Make standalone Python snippets self-contained

T5 uses re but does not import it in that snippet. Either run as one consolidated script or add explicit imports in each snippet.

Add:

Prefer one consolidated inspect_package.py so imports, sanitizer, and parsed structures are shared. If separate snippets are used, each must include its own imports.

---

3. Direction to Opus

Apply the three patches above and dispatch PF-R2.

Do not ask for another GPT review if only these exact patches are applied.

---

4. Boundary

Execute R2 is still not authorized. After PF-R2 PASS, Opus should submit the PF-R2 report and then draft Execute R2 using the D32 execute pattern plus mandatory fresh SSH VPS preflight.