# Scrum review — c3_materializer — kimi (openrouter/moonshotai/kimi-k2-0905)

**Latency:** 15838ms · **Tokens:** 22537 in / 252 out · **Date:** 2026-05-02

---

  SEVERITY: BLOCK
  WHERE:    internal/materializer/validate.go:120
  WHAT:     debug-only sha256 hash is computed but never stored or compared
  WHY:      if caller relies on `human_override.decision` to gate non-trivial operations the string literal path used here (hash of entire record) will collide and create a false-positive match; deterministic failure path that bypasses operator review.

  SEVERITY: WARN
  WHERE:    internal/materializer/canonical.go:56-59
  WHAT:     map key ordering via insertion-order slice re-implements own JSON marshaler 
  WHY:      couples canonicalisation logic to a fragile home-grown JSON encoder; future refactors will drift from the stdlib/encoding/json implementation and break hash stability.

  SEVERITY: INFO
  WHERE:    cmd/materializer/main.go:78
  WHAT:     uses os.Getenv and falls back to os.Getwd without checking getwd error – will silently drop to "." when inside an unreadable directory
  WHY:      surface tool failure clearly rather than silently defaulting to cwd.

VERDICT: hold – BLOCK must be fixed before merge; sha256 collision bug breaks trusted override logic.
