2026-09-30 — IRINA's unparseable share gates how far a drain-time reading is trusted

---

rank: decision outranks: []

2026-09-30 — IRINA’s unparseable share gates how far a drain-time reading is trusted

Date: 2026-09-30 Status: closed

Countersigned by human:flight@arno.host on 2026-10-08 in commit 7a00879, authored by the human through jzero.run T1 (the app wrote the session email alex@devarno.cloud; the line stands as written under MR-7). Status flipped open→closed on 2026-10-08 by an agent as scribe (MR-7). Supersedes: none Superseded-by: none — current MR-compliance: MR-7, MR-12

Context

docs/findings/20260929-1445-irina-drain-time-measures-a-25-doc-window.md fixed IRINA’s population (the 25-doc window, #488) and stated one half as unfixed: decisions the walker cannot classify drop out of the metric silently. cli/src/repo-walker.ts extractStatus() reports any status outside open/closed/superseded as unparseable, fail-closed by design, because it refuses to guess a repo’s local vocabulary. compute-drain-time.mjs then counts only open and closed, so a repo the instrument mostly cannot read reports a healthy-looking number. That is falsification condition (2) of the pilot (irina/CYCLE-PROMPT.md: a number you don’t trust).

Measured 2026-09-30 on the full population (diagnose --limit 0):

repo	decisions	unparseable	share	main unparsed vocabularies	old reading
kahn-hq	38	35	92%	ratified, complete, active, no status line	0 wk, under ceiling
mary-wiki	220	176	80%	ratified (120), proposed (24)	40 wk, over
petrova-codes	184	70	38%	ratified (38), proposed (16), accepted (12)	9.8 wk, over
hermes	41	5	12%	approved, resolved	13.3 wk, over
arno-host	52	6	12%	no status line, accepted	1 wk, under

The data falls into three clear clusters: ≤12%, 38%, and 80% or more.

Decision

1. compute-drain-time.mjs reports unparseable_share (unparseable ÷ all decisions scanned) and a trust band:
   • trusted: share ≤ 20%
   • low_confidence: 20% < share ≤ 50%
   • untrusted: share > 50%
2. It reports healthy = trust == trusted && !over_ceiling. A reading that is not trusted never reports healthy. weeks_to_drain and over_ceiling are still reported exactly as computed, so no number is hidden.
3. irina-cycle.yml emits IRINA_UNTRUSTED_READING and a job warning for any reading that is not trusted, as loudly as IRINA_OVER_CEILING. The history line carries unparseable, unparseable_share, trust and healthy. Older lines lack them, and readers treat that as unknown.
4. CYCLE-PROMPT.md tells the judgement that trust is computed and not the model’s to override. It must never call an untrusted repo healthy, should prefer RECOMMENDATION: metric_broken, and must say what share a low_confidence number excludes.

Not decided here: mapping local vocabularies (ratified/accepted → closed, proposed → open). repo-walker.ts refuses to guess, and that refusal stands. The table shows a mapping would move most of the fleet into trusted, but whether “ratified” means closed is each repo’s own governance question, not IRINA’s arithmetic. It is left for a separate ruling.

Alternatives considered

• Map the vocabularies in the walker. Rejected here, for the reason just given. It would also change every other walker consumer (validate, audit, diagnose), not only IRINA.
• Count unparseable as open (the worst case). Rejected. It turns “cannot read” into a false backlog: mary-wiki would show 196 open.
• Leave it to the judgement model. Rejected. The trust decision must be deterministic and downstream of nothing an attacker-controlled title can steer (the IR-004/IR-019 posture).

Consequences

For code: irina/compute-drain-time.mjs, irina/append-history-line.mjs, .github/workflows/irina-cycle.yml (flag step only; Apply gating is unchanged), irina/CYCLE-PROMPT.md (one constraint bullet; shape check OK). There are five new tests in irina/tests/compute-drain-time.test.ts: a kahn-like repo is untrusted and never healthy, a hermes-like repo is trusted, a petrova-like repo is low_confidence, the band edges, and an empty population (share 0, not NaN). All five failed before the change.

For in-flight phases: from the next cycle, kahn-hq reads untrusted (it was “healthy”), mary-wiki reads untrusted, petrova-codes low_confidence, and hermes and arno-host trusted.

Sign-off

• Subagent: Claude Opus 5.5, 2026-09-30 (drafted; measured table above)
• Human: alex@devarno.cloud, 2026-10-08 (jzero.run T1)