Codex reviewed the implementation independently. Claude Fable reviewed the design and an implementation snapshot through the working subscription, with built-in tools disabled. The implementation review reported claude-fable-5-1; the provider returned $1.83453275 as list-price-equivalent accounting, not a claim about an extra charge. Review text is preserved in Fable implementation review. It describes the earlier snapshot, not the final source.
| Finding | Disposition |
|---|---|
| Reusing evidence directories mixes runs | Nonempty directories are rejected; test verifies old manifest remains unchanged. |
| Discovery recorded actions without verifying postconditions | Verify each executed step before recording; premature finish/review tests reject false success. |
| Review-transition modal loses correct replay position | Separate form-arrival and blocked-review semantics; retain inputs and retry the read-only review click. Both modal timings tested. |
| Delayed pause/resume can resurrect terminated control | Termination guards and stale epoch checks; explicit race test. |
| Human capture misses gestures outside claimed ownership | Record all UI gestures with owner-at-receipt and busy flag. Human-owned events retain that attribution. No OS input-lock claim. |
| Missing abort and resume-state evidence | Operator console includes Abort run; resuming and failed-verification rollback emit ownership changes. |
| Result disagrees with redacted contract | Both vendor and invoice reference explicitly declare redacted outputs; remaining outputs retain their types. |
| Text click can match a heading | Text targets must resolve to an interactive link/button ancestor. |
| Hidden or misleading review content can pass | Require visible panel/rows and label-column matching; compare every expected field. Test hidden rows and data values named Date. |
| Runtime messages collide with invoice data | Conditions scoped to visible alert/dialog/heading roles. Reproduced false held-vendor result, then fixed and tested. |
| Short values corrupt observation text | Bounded Unicode token matching; trusted labels preserved. |
| Trusted target exemption bypasses sibling redaction | Preserve only known text property; recursively redact sibling properties. Reproduced failing sentinel test, then fixed. |
| Last-step condition skips recovery classification | Replay classifies conditions before deciding completion on every loop iteration. |
| Discovery does not learn the session-notice rule | Intentional bound: discovery stops on interruptions. Compiler attaches reviewed host rules; report does not claim rules were inferred from a happy-path transcript. |
| Early errors/type refinements | Runtime failures get a run header and structured result; cleanup always finishes the manifest. Recorded actions enforce binding/postcondition consistency. Input parsing errors before run initialization remain CLI validation errors. |
Before the LangGraph migration, npm run check and npm test passed (23 tests). Live discovery and zero-model replays are linked in the evidence index. Human-operated capture remains pending; automated takeover is labeled clearly. The surface and masking profile target LedgerDesk 1.0 only; desktop and tenant infrastructure remain design work.
The user requested meaningful LangGraph orchestration. Fable design review and independent Codex review challenged interrupt reentry, checkpoint privacy, recursion limits and tracing. The final source uses separate observe/decide/execute/verify/compile nodes, an independent pause/interrupt/verify-resume graph, exact pinned versions and private MemorySaver handles. Node errors are normalized before pending writes; no raw browser or inputs enter graph state. Codex's final scoped source review found no remaining concrete issues.
A broad Fable migration code review timed out after240 seconds and is not represented as a completed review. A smaller handoff/checkpoint review completed successfully through claude-fable-5-1. Its dispositions:
- Final checkpoint-export failure could escape after resumed ownership. Reproduced in a failing test; export now emits a safe
evidence_write_failedcode and terminates ownership. - The driver-captured response epoch checks for changes during invoke; the independent required guard is exactly
pausedEpoch + 1, alongside automation ownership. The payload does not claim to be an independently authenticated operator token. - Tracing flags are now consistently refused whenever nonempty, including legacy values. This intentionally requires clearing flags, and applies to the standalone CLI boundary.
- Epoch schema rejects negatives. Intervention input is runtime-validated before graph state creation; reason/resume points are fixed and run IDs are opaque.
Fresh visual review read all three new contact sheets. Discovery and handoff progression are visible. Fast replay omits intermediate fill states and repeats the final screen; the full event log and video supplement it. Videos are explicitly unmasked fictional data. A masked PNG capture can briefly flash in the video. Pixel evidence does not itself prove framework use, ownership, no-model execution or absence of posting.
Earlier Fable visual/source suggestions were checked against the strict schema. Output transform and checkpoint variants are rejected by artifact validation, so hypothetical alternate transforms are not accepted runtime cases. Session notices during review now have a scoped wait/recovery path; a regression reproduced the old timeout. Resume points are named continue_form to describe preserved-state continuation. Native dialogs remain terminal by policy.
Final tests include full graph routing, safe raw state/tuple/pending-write inspection before export, failure-history privacy, one pause and navigation across interrupt resume, fabricated continuation rejection, and evidence-write failure. Human-operated recording remains pending.
Package validation at the 28-test revision: formatting and TypeScript checks passed; all 28 tests passed. A clean staged-file copy installed with npm ci, typechecked, and replayed the included artifact successfully with CLAUDE_BIN=/nonexistent. Verification record records source hashes from that revision.
A later shipping review found the operator console (src/operator.ts) had no automated coverage: the handoff evidence script drives the controller through a callback and never touches the console's HTTP endpoints. tests/operator.test.ts now exercises the real console with an automated client: private-link and key checks, resume-before-claim rejection, claim, stale-epoch and unresolved-notice rejection with control retained, same-page dismissal recorded as an operator action, resume to success, console shutdown, and abort. The console gained an injectable link announcer so tests can reach it without parsing stderr; CLI behavior is unchanged. The shared test artifact moved to tests/helpers/artifact.ts so test files do not import each other. A follow-up pass added verify-review and timeout console tests (the timeout timer starts only when the handoff opens), renamed the human_resume field operator: local-human to transport: local-operator-console because the console can be driven automatically and ownership human is a control state rather than proof of a person, and added scripts/console-evidence.ts, which drives the actual console web page in a separate Playwright context via the announcer callback. Suite is now 32 tests. The final verification record covers this 32-test revision and a fresh recorded console run with Claude unavailable.