# Scrum review — c1_validatord — opus (opencode/claude-opus-4-7)

**Latency:** 18077ms · **Tokens:** 6 in / 836 out · **Date:** 2026-05-02

---

SEVERITY: WARN
WHERE:    cmd/validatord/main.go:178
WHAT:     mergeContext lets caller-supplied artifact._context override request context, opposite of comment in handleValidate flow.
WHY:      Comment says "caller-supplied artifact._context wins on key collision," but for /iterate the artifact is LLM-generated; trusting model output to override server context is a privilege-inversion risk for fields like client_id/target_count.

SEVERITY: WARN
WHERE:    internal/validator/iterate.go:159
WHAT:     ExtractJSON's brace-balance scan ignores `{` and `}` inside JSON string literals.
WHY:      Inputs like `{"k":"a}b"}` break depth tracking — the `}` inside the string closes the object early and the remaining `"}` makes parseObject fail; cross-runtime parity claim with Rust depends on Rust having the same bug.

SEVERITY: WARN
WHERE:    cmd/validatord/main.go:259
WHAT:     chatCaller reads entire response body with `io.ReadAll` with no size cap.
WHY:      A misbehaving/compromised chatd could return an unbounded body and OOM validatord; the request side caps at 4 MiB but the response side does not.

SEVERITY: INFO
WHERE:    internal/validator/iterate.go:121
WHAT:     `errSummary := vErr.Error()` feeds full error text back to the model unbounded.
WHY:      No truncation on the corrective prompt; pathological validators with long Reason strings could blow context windows, but unlikely in practice.

SEVERITY: INFO
WHERE:    internal/validator/iterate.go:235
WHAT:     `trim` duplicates the same helper in cmd/validatord/main.go.
WHY:      Two copies of a 4-line byte-prefix trimmer; harmless but worth consolidating into shared.

SEVERITY: INFO
WHERE:    cmd/validatord/main.go:117
WHAT:     Comment says validators "only ever return ValidationError" but coerces other errors to a Schema ValidationError with 422 instead of 500.
WHY:      Comment promises 500 ("Surface as 500 rather than silently coercing") but code returns the error as a ValidationError, which the caller renders as 422 — comment and behavior disagree.

VERDICT: ship-with-fixes — context-merge precedence + response size cap worth addressing.
