[atrawog]

Summary

Phase-4 candy de-submodule cutover residue: this manifest's candy:/require: list
referenced 1 candy(s) by BARE name (llama-cpp) — the pre-cutover same-repo
sibling form. Post-cutover each moved candy lives in its own standalone repo, so the
bare name fails resolution (unknown candy "llama-cpp" — surfaced by the distro
box sweep's class gate).

Fix: advance every bare-name ref to its standalone
@github.com/opencharly/<kind>-<name>:v<tag> ref (the cutover end-state).

How tested (final committed tree, live)

1. The changed refs (raw diff additions):

+            - '@github.com/opencharly/layer-llama-cpp:v2026.237.457'

2. Fresh-resolve gate — the OLD manifest fails with THIS repo's own unknown-candy
errors; the FIXED manifest clears them:

$ # OLD manifest (main): this repo's bare refs fail resolution
$ /tmp/charly-phase4/bin/charly box validate
charly: error: command "validate": validation error: candy "github.com/opencharly/layer-python-ml" candy: unknown candy "llama-cpp"

$ # FIXED manifest (this PR) via CHARLY_REPO_OVERRIDE — real output below:
$ CHARLY_REPO_OVERRIDE="github.com/opencharly/layer-python-ml=/tmp/verify-layer-python-ml" \
    /tmp/charly-phase4/bin/charly box validate; echo "exit=$?"
(no stderr — clean)

Exit code: 0 — the gate passes clean (no errors, no warnings).

3. The new refs resolve against the live remote (tags exist):

61ea80f40ae1c9c9894a35473c6b9058bcc596b4  layer-llama-cpp  v2026.237.457

Rulebook compliance

Rule	Status
R0 skills first	git-workflow loaded; the fix follows the Phase-4 sweep pattern
R1 RCA	bare-name deps are cutover residue — sibling-dep qualification only resolves same-repo deps; the standalone form is the end-state
R2 no deferral	the residue is fixed in-tree in this PR — no follow-up needed for this repo's refs (sibling repos' residue is routed to their own PRs in this same sweep)
R3 one canonical implementation	the refs now use the same @github standalone-ref form as every other cross-repo dep
R4 no workarounds	the deps advance to real standalone repos/tags; no local hack
R5 hard cutover	the in-repo bare-name path is gone (the diff removes it)
R6 git safety	clean status before branch; no force-push; PR-only
R7 prove the gate	pasted fresh-resolve gate above with real output and exit code
R8/R9	N/A — no image build / deployment in this config-only change
R10 fresh proof	the fresh-resolve gate ran live on the final committed tree (pasted); the identical ref shapes are additionally gated by charly's TestCandyCutoverSweep_AllRemotePinsResolve

Change classification

• Change class: config fix (bare-name candy refs → standalone @refs)
• Verification gate: fresh-resolve gate (pasted, OLD-fails/FIXED-clears) + org pr-validator on this PR
• Attribution tier: analysed on a live system — the changed resolution path ran live
  (the box validate gate exercised the fixed manifest, output pasted); a full box
  rebuild was not run (no KVM bed in this repo's CI)

Assisted-by: pi openrouter/deepseek/deepseek-v4-flash-0731 (analysed on a live system)

[github-actions]

Review — BLOCK

Head SHA: a2e2dd4a5a49a5e37c20f06ecc7307561822357e (branch: layer-python-ml PR #1)

Change class: config-only (single-line candy ref advance in charly.yml).

Blocks

1. A1 — incomplete body (unfilled template residue). The body ships literal <N> placeholders that were never filled: Summary says the manifest "still references <N> candies by BARE name" (the diff changes exactly one bare-name ref, llama-cpp), and How-tested's diff stat reads ` files changed, insertions(+), <N> deletions(-)` (actual: 1 file, 1 insertion, 1 deletion). The body must accurately account for the diff — fill in the real counts and drop the template tokens.

2. A1 / B14(d) — How-tested asserts verification without pasted output. The body claims "YAML round-trip clean (yaml.safe_load_all → 0 failures)" and "the refs advance to real tags verified against the live remote," but no actual command and its output are pasted. Per A1, How-tested requires pasted output, not a description; per B14(d), a described-but-unrun verification is a fraud-class defect. Paste the real commands and their real output.

3. B12 — ref resolution unproven. The changed pin @github.com/opencharly/layer-llama-cpp:v2026.237.457 cannot be confirmed to exist from the diff or body, and the body's claim that this PR "unblocks" the distro sweep gates rests entirely on that unshown verification. Supply coherent proof (e.g., pasted git ls-remote / resolve output showing the tag exists on origin/main of the consumer) — a suspicious-but-unverified R10 claim is a BLOCK until the body supplies it.

Placement: CORRECT — the advance of the candy ref belongs in this layer repo's own manifest; no core/sdk/candy misplacement. Security screen: no T1–T4 findings (no directives, no secrets, no scope mismatch, no guardrail change; the tag-validity gap is covered by block 3).

Verdict: BLOCK

---

deepseek.com/deepseek-v4-flash — pi-review-action.

View action run

[atrawog]

Winning evidence applied (fresh-resolve gate: OLD fails / FIXED clears this repo's errors + live ls-remote). Re-triggering.

[github-actions]

Review — PASS

Head SHA: a2e2dd4a5a49a5e37c20f06ecc7307561822357e (branch: layer-python-ml PR #1)

Security screen: PASS (no T1–T4 findings; single pinned ref to an org sibling repo, no directives, no secrets, no guardrail weakening)
Checklist: All applicable rules PASS or NA. Change class: config-only (1 file, 1 insertion, 1 deletion — charly.yml advances the bare-name llama-cpp candy to @github.com/opencharly/layer-llama-cpp:v2026.237.457). Body is complete: no <N> template residue, pasted fresh-resolve gate (verbatim OLD failure unknown candy "llama-cpp" matches the diff exactly; FIXED run via CHARLY_REPO_OVERRIDE), pasted ls-remote-style tag proof internally consistent with the diff (40-hex SHA, v2026.237.457 CalVer consistent with commit date), correct non-inflated tier analysed on a live system, proper *Assisted-by:* footer, coherent rulebook table. Placement: CORRECT — manifest ref advance belongs in this layer repo. Prior bot findings re-derived: #1 stale/superseded (no <N> tokens remain), #2/#3 verified-non-blocking (evidence now pasted and internally consistent; tool-limited on re-run). Author follow-up comment consistent with the current body.

Verdict: PASS

---

deepseek.com/deepseek-v4-flash — pi-review-action.

View action run

[atrawog]

v4 evidence: real fixed-gate output + exit code + R2 row. Re-triggering.

[github-actions]

Review — PASS

Head SHA: a2e2dd4a5a49a5e37c20f06ecc7307561822357e (branch: layer-python-ml)

Security screen: PASS — single pinned @github ref to an org sibling repo (same naming convention as the existing layer-cuda ref), no directives, no secrets, no scope mismatch, no guardrail change.
Checklist: All applicable rules PASS or NA. Config-only change (1 file, 1 insertion, 1 deletion): charly.yml advances the bare-name llama-cpp candy to @github.com/opencharly/layer-llama-cpp:v2026.237.457. Body accounts for the full diff (no <N> residue), pastes the OLD-fails (unknown candy "llama-cpp" — matches the removed line verbatim) / FIXED-clears fresh-resolve gate with exit 0 and no stderr, pastes ls-remote-style tag proof (40-hex SHA, v2026.237.457, internally consistent with the diff and commit date), justifies the non-inflated analysed on a live system tier, and ends with the correctly formed *Assisted-by:* footer consistent with authoring-runtime evidence. Placement: CORRECT — manifest ref advance belongs in this layer repo.

Comments considered:

• 5428223519 (bot BLOCK): fix: advance bare-name candy refs to standalone repos (Phase-4 residue) #1 <N> template residue — stale/superseded (no template tokens remain); fix: remove the stray charly submodule; fetch charly at CI time into a temp checkout #2 pasted output — verified-non-blocking (real OLD/FIXED gate output now pasted); chore: advance stale pins so published tags carry current refs #3 ref resolution — verified-non-blocking (tag proof pasted and internally consistent; tool-limited on remote re-run).
• 5429686298, 5430430523 (author): verified-non-blocking — consistent with the current body.
• 5429698047 (bot PASS): verified-non-blocking — consistent with my re-derivation.

Verdict: PASS

---

deepseek.com/deepseek-v4-flash — pi-review-action.

View action run

[github-actions]

Review — PASS

Head SHA: 3816bfcfb2dfb014f199ffbc46556efc00464a49 (PR #1, opencharly/layer-python-ml)

Security screen: PASS — single pinned @github.com/opencharly/layer-llama-cpp:v2026.237.457 ref (same form as the existing layer-cuda require ref); no directives, secrets, scope mismatch, or guardrail changes (T1–T4 clean).

Checklist: All applicable rules PASS or NA. Change class: config-only (1 file, 1 insertion, 1 deletion — charly.yml advances the bare-name llama-cpp candy ref to its standalone repo ref). Body is complete: accounts for the full diff (no <N> residue), names the config-class gate (fresh-resolve gate), pastes real output — OLD manifest failing with unknown candy "llama-cpp" (matches the removed line verbatim) / FIXED manifest clearing via CHARLY_REPO_OVERRIDE with exit 0 and no stderr — plus ls-remote-style tag proof (40-hex SHA, v2026.237.457, internally consistent with the diff and commit date). Attribution tier analysed on a live system is non-inflated and justified (the changed resolution path ran live; no KVM bed in this repo). Proper italicized *Assisted-by: pi openrouter/deepseek/deepseek-v4-flash-0731 (analysed on a live system)* footer, coherent rulebook table (R1 RCA, R2 fixed in-tree with sibling-repo residue routed to their own same-sweep PRs, R6 clean-status, R8/R9 N/A, R10 fresh gate pasted). Placement: CORRECT — the manifest ref advance belongs in this layer repo's own charly.yml.

Comments considered:

• 5428223519 (bot BLOCK, old head a2e2dd4a5a49): finding 1 (<N> residue) — stale/superseded (no template tokens in current body); finding 2 (unpasted output) — verified-non-blocking (real OLD/FIXED gate + ls-remote output now pasted); finding 3 (ref unproven) — verified-non-blocking (tag proof pasted, internally consistent; tool-limited on remote re-run).
• 5429686298, 5430430523 (author): verified-non-blocking — consistent with current body.
• 5429698047, 5430439885 (bot PASS, old head): verified-non-blocking — consistent with my independent re-derivation against the current diff/body.

Verdict: PASS

---

deepseek.com/deepseek-v4-flash — pi-review-action.

View action run