Workshop lens can mark itself moved_on without producing its artifact (hollow completion; before-implement gate trusts the flag)

[alonf]

Summary

A design-workshop lens records moved_on: true / human-confirmed in lens-applicability.json even when it never produced its canonical artifact or asked its required questions. The before-implement gate (and downstream consumers) trust the moved_on flag, not the artifact — so a hollow workshop passes the gate and the lifecycle reports "workshop complete."

Found

F-197 iteration-007 real-host dogfood — EnglishIntake project, Copilot host, 2026-06-25.

Evidence (artifact-level)

In specs/001-english-intake/:

• lens-applicability.json marks the code-implementation lens moved_on: true / human-confirmed.
• BUT implementation-rules.yml — the lens's canonical output manifest — does not exist on disk.
• AND workshop/code-implementation.md has 0 'review' mentions — the reviewer-host question (a required step of the code-implementation lens) was never asked.
• before-implement was nonetheless authorized on this state; the crew greets a new session with "workshop complete, ready to execute T001."

The user's own words on returning: "I didn't finish the workshop — how come it thinks I did?" — and they were right.

Impact

The lens completion signal (moved_on) is decoupled from the lens artifact (the manifest + its required decisions). A lens — or an agent driving it — can self-certify complete while producing nothing:

• The implementation-rules.yml manifest that plan / implement consume is silently absent.
• The reviewer-host choice the continuous co-review needs is silently absent → the navigator fail-opens at implement (a related but separate bug).

No downstream signal flags any of this. The lifecycle trusted a flag an agent set.

Fix direction

Lens completion (and/or the before-implement gate) must assert the artifact exists, deterministically — not trust agent self-report:

• moved_on: code-implementation for a code-writing feature requires implementation-rules.yml on disk with its required fields (including reviewer_preference).
• Generalize: each lens declares its required output; moved_on is only honest if that output validates against the lens's schema.

Related

Part of the F-197 iter-007 reviewer-host dogfood cluster (the reviewer question being asked-blind / skipped across hosts — Copilot skipped it entirely; Codex asked but presented no list/default). The present-the-list half is fixed (commit 422213c1); this completion-integrity gap is what let the skip pass silently and is arguably the most important of the cluster.