[wshallwshall]

Merge danger

Reversible: yes -- a revert of the squash commit undoes all of it. Docs and one test-string change only; no code moves.

Blast radius: docs/adr/0030-anonymization-test-harness-tee.md, docs/adr/README.md (the 0030 index row), and the _REAL_ANON_IMPORT_ADVICE string plus its comment in tests/test_dependency_boundaries.py. _ANON_MODULE is untouched and anon/ does not move.

Evidence

• Before: ADR 0030 section 1 said the harness imports messagefoundry.anon directly. No harness file does, and the owner ruling of 2026-10-12 (BACKLOG #3006 part 3) records that. ADR 0030 also carried no record of ADR 0201's planned move of anon/ into messagefoundry_toolkit.
• After: the amendment section records the planned move (marked PROPOSED, awaiting the owner's sign-off, as ADR 0201 section 5 requires), corrects the harness sentence and keeps the old text as a record. Builder checks: ruff and ruff format clean, all four mypy legs clean, 185 passed on the doc and boundary tests on this branch.

Why this is its own pull request

ADR 0201 section 5 says the ADR 0030 amendment "lands in its own PR" and "needs the owner's sign-off on its own, not buried in a mechanical diff". Section 7 says each slice is one PR. The rest of batch 448's engine work rides the batch PR.

BACKLOG #1192, ADR 0201 slice 5 (batch 448)

• Source branch: b448-1192-slice-5, head e110c3a2c939987ef3ec5e12a61fbc159ac3a894, base origin/main 4e52f4ede.
• Slices 3 (separate batch PR), 4, 6, 7 and the release-gated re-score remain on fix(cli): redact a handler exception's text on the dryrun and check surfaces (BACKLOG #1668) #1192.

What changed

• The amendment bullet records ADR 0201 section 5's four points: the home becomes messagefoundry_toolkit/anon/; the rule table stays the single authority and the tee still vendors a copy (not every file byte-identical; tests/test_anon_parity.py records which are); the parity check re-points in slice 6; the extension of the CLAUDE.md section 4 carve-out to anon/ is withdrawn (it never landed).
• The four places that state the carve-out flip each say "withdrawal proposed".
• Section 1's harness sentence now says no harness file imports the package, and that CaptureSink anonymizes only when its caller passes an anonymizer; the shipped python -m harness.reconcile capture passes none.
• The README row for 0030 notes the earlier amendments and this proposed one.
• ADR 0201 itself was not edited.

Owner action

The amendment is marked PROPOSED. The owner's sign-off is what ADR 0201 section 5 asks for; whoever records it edits that banner bullet.

Open review findings (round 2, shipped per korus BUILDER.md 4c)

1. ADR 0030 section 6 still says the harness capture's JSONL carries a de-identified raw, which section 1 now contradicts. The contradiction pre-existed; this change made it visible. Section 6 carries no marker. This one needs a follow-up row: an unmarked section 6 could lead a reader to run capture against real traffic.
2. The closing "On acceptance" paragraph also names the CLAUDE.md section 4 flip and has no marker.
3. Lines 5, 95, 197 and 476 still say byte-identical with no marker.
4. The "engine-owned" home statements (one-line decision, section 1 heading, To resolve) carry no marker.
5. The reviewer argues that removing section 1's "same rules, harness by import" design statement is decision-level and should wait for sign-off.
6. _REAL_ANON_IMPORT_ADVICE wording "its correction says none does" sits oddly inside a failure that just found an import.
7. The fact that capture writes raw bodies is now stated twice (section 1 and PHI.md's harness table), and section 1 does not link to PHI.md.

Unread legs

None specific; read the required contexts as usual.

Proposed ledger banner (#1192)

Carried verbatim from the branch's final commit message for the Lander.

Proposed ledger banner: #1192: ADR 0201 slice 5 built (ADR 0030 carries
a proposed amendment for the anon/ move, awaiting the owner's sign-off on
this PR, and its harness-import sentence is corrected). Slice 3 is on its
own PR; slices 4, 6, 7 and the release-gated 15.2.3 re-score (slice 8)
remain.

Confidence Score: 5/5

The reviewed changes appear safe to merge, with the move still explicitly pending the owner’s sign-off.

Summary

ADR 0030 now proposes moving anon/ into messagefoundry_toolkit/anon/, pending the owner’s sign-off. It also corrects the harness-import claim and updates the ADR index and boundary-test advice.

• ADR 0030 marks the anonymizer move as a proposal.
• The ADR and boundary-test advice now describe harness anonymization accurately.

_{Reviews (1) · Last reviewed commit: "ADR 0201 slice 5: code-review round 1 re..." · Reviewed by Greptile}

[wshallwshall]

QA -- korus roles/BUILDER.md step 11 (BACKLOG #1192, slices 3 and 5, one review over both)
Level: xhigh, from the brief. Tag: xhigh effort → 10 inline angles → dedup (no verify) → sweep → ≤15 findings (forks af5b0ccc480af0b83 round-6733012313, a419f47240e2c5056 round-75b3fdd824).
Rounds: 2. Findings: round 1 had 13 findings: 11 fixed, 2 split out or left open (the separate-PR finding answered by the split branches; the stale ADR 0201 and release.yml records left as row 4 below), 0 rejected. Round 2 had 11 findings, all open, none fixed: round two is the stop.
review_tag.py run from korus origin/main 20af3e604237db7293729b7048dae3657b738b56; exited 0 on both rounds and placed both forks by inheritedWorktreePath.

[wshallwshall]

Lander (session 8a04c9f3), 2026-10-28. Enqueuing at pinned head b7daca92142399e75996efc53336020e10395768.

Review proof: the Builder's QA line (xhigh, two rounds, review_tag.py exit 0). All nine required contexts are completed and successful on this head.

Open findings, each filed on vault main (vault PR 2734, merged 9ba0487fc), none changing product behaviour or weakening a control:

• Finding 1: #4667
• Findings 2 to 7: #4668