[ptr727]

Summary

This answers the third round of review findings on the promotion pull request #3521:

• A tier sharing the maintainer-only model. spec/validate.py now rejects a tool mapping where another tier names the maintainer-only model. The comparison ignores case, as the guard's own comparison does. Without it, the guard would block that name and refuse every dispatch at the other tier. A new test covers frontier mapped to Fable.
• Requirement 10's allowance sentence. It was read twice as a claim about what an agent cannot do, against the nested-session bound the same requirement names. It now says that setting the allowance is the maintainer's act. It also says that an agent never doing it is conduct the hook does not enforce.

Local review, declined

• spec/validate.py model_tier_errors: the check matches the guard's Agent path, an equality ignoring case. The guard's Workflow path matches the blocked alias as a word inside a script's model value, so a lower tier mapped to a variant such as opus[1m] beside a reserved opus would pass here. Two things rule it out under GOVERNANCE.md "Trust Boundaries and Hardening Effort". The config is trusted hub content, and the failure would be a loud refusal with a stated reason, not a silent one. Mirroring the regex would also put a second copy of the guard's matching rule in the validator.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: ptr727/ProjectTemplate
• Branch: promotion-3521-tier-alias
• File: .coderabbit.yaml
• Commit: 129b856
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3ef2e005-60e4-4152-a0e3-758937125105

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ptr727]

A recorded local strict-review pass covers head 08e3e4a6fb15cc45d5757da09dcb11cee5f7663b, the content this pull request carries at that commit against develop, and it recorded 1 finding.

[Copilot]

🟡 Changes recommended

model_tier_errors can raise TypeError for a non-string maintainerOnly value instead of returning validation errors.

1 open issue

• Guard non-string maintainerOnly values before dictionary lookup · New

What changed in this PR

This pull request prevents non-maintainer tiers from sharing the maintainer-only model and clarifies allowance ownership and enforcement boundaries in the agent-safety documentation.

Changes:

• Rejects case-insensitive sharing of the maintainer-only model across tiers.
• Adds regression coverage for a tier mapped to Fable.
• Clarifies that maintainers set the allowance and that agent conduct is not hook-enforced.
• Identifies a remaining validation issue for non-string maintainerOnly values.

File	Description
tests/​test_spec_validate.py	Adds regression coverage for case-insensitive sharing of the maintainer-only model.
spec/​validate.py	Prevents another tier from sharing the maintainer-only model; requires a guard for non-string maintainerOnly values.
host-setup/​agent-safety/​README.md	Clarifies maintainer allowance responsibility and hook enforcement boundaries.

_{Review effort: Lite}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.56%. Comparing base (0dd58f6) to head (129b856).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #3524      +/-   ##
===========================================
+ Coverage    81.54%   81.56%   +0.01%     
===========================================
  Files           26       26              
  Lines         8967     8970       +3     
===========================================
+ Hits          7312     7316       +4     
+ Misses        1655     1654       -1     

Flag	Coverage Δ
python-3.13	81.56% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ptr727]

A recorded local strict-review pass covers head 129b8564096c36769df6b4163fffb5d64fa16cc6, the content this pull request carries at that commit against develop, and it recorded 0 findings.