Two agents reviewed the concept note adversarially on 29-09-2026, each without a stake in it and without seeing the other's work. Each read the note against the prototype, eRegulations v7's code and the vertical-base template.
| Reviewer | Verdict | Blocker | Major | Minor |
|---|---|---|---|---|
| Claude | Freeze after fixes | 3 | 7 | 6 |
| Codex | Rework before freezing | 3 | 8 | 2 |
Their 29 findings merge into 21. Twenty were folded into the note the same day; eight need the analyst and became questions ?7 to ?14.
| # | Severity | Finding | Raised by | What became of it |
|---|---|---|---|---|
| R1 | blocker | The contract cannot "keep ASYCUDA's shapes": v7's public API has its own; it holds amounts as whole numbers, results as single-precision figures, and one currency per request. | Claude C2 · Codex C1 | Folded, §3: the calculator's own contract, each provider translating. Confirmed by ?7 |
| R2 | blocker | D14 sends OBR's requests to v7 while D2 says v7 is untouched. | Claude C1 · Codex C9 | Folded, §5 and §8. Asked, ?8 |
| R3 | blocker | The template chooses one adapter per installation; a provider per country, and two at once, is new code. | Claude C3 · Codex C7 | Folded, §3. Asked, ?9 |
| R4 | blocker | Shadow mode is not possible while OBR's test host is silent and no other host answers the new server. | Claude C5 · Codex C2 | Folded, §3 and §7. Asked, ?10 |
| R5 | blocker | The legal and accuracy risk of a computed figure is understated for Burundi's bases, flat charges, currencies and levies. | Codex C3 | Folded, §4: one sheet per tax in step 4. Asked, ?13 |
| R6 | major | Rwanda is not reached through ASYCUDA but through its trade portal, with a borrowed referrer and no agreement. | Claude C4 | Folded, §7. Asked, ?11 |
| R7 | major | Only one real declaration is on record; an exact match would reproduce OBR's known defects. | Claude C6 | Folded, §4: a register of known defects. Asked, ?12 |
| R8 | major | The EAC tariff differs by member: stays, remissions, COMESA preferences. | Claude C7 | Folded, §4 and §7 |
| R9 | major | Embedding and abuse are unspecified: CORS open to all, a forgeable rate-limit key, customs quota spent by the public. | Claude C8 · Codex C5, C6 | Folded, §5: six requirements for modules 8 and 10 |
| R10 | major | Nobody is named to host, hold the key or update the tariff after handover. | Claude C9 · Codex question 5 | Asked, ?14 |
| R11 | major | The project's seven steps and the template's twelve documents collide; the template is built for signed-in applicants. | Claude C10 · Codex C7 | Folded, §6: the seven steps govern; what is set aside |
| R12 | major | A green check gate proves neither integration, security, accessibility, load nor use. | Codex C8 | Folded, §6: four checks per phase |
| R13 | major | OBR's requests of 24-09 are not traced into scope. | Codex C10 | Folded, new §8 |
| R14 | major | No data source is named with its authority, format, frequency and checker. | Codex C11 | Folded, §4: a data register per country |
| R15 | major | "Data, never code" is too absolute: Rwanda already needs an extra input for vehicles. | Codex C4 | Folded, §4: data and parameters, plus declared rules with tests |
| R16 | minor | Nine routes, not four; the prototype began on 04-08; Admin PR #26 omitted; the template has more than one commit. | Claude C11 · Codex C12, C13 | Folded, §1, §9, sources; each checked against the repositories |
| R17 | minor | D1 decides a retirement that §5 defers; D13 narrows D5 without naming it. | Claude C12 | Folded, D1 and D13 reworded, §5, §7 |
| R18 | minor | Staleness is not only a July event (TSR changed in December 2025); exchange rates need their own validity. | Claude C13 | Folded, §4 and §9 |
| R19 | minor | Four connectors and publishing come before one pilot has passed. | Claude C14 | Folded, §4 and §6: CSV and manual entry only for 7.2 |
| R20 | minor | Languages, accessibility, printing, health and data protection are missing. | Claude C15 | Folded, §2, one owning module each |
| R21 | minor | Two claims had no citation. | Claude C16 | Folded, §1 and the short answers |
TariffsBO, 644 for tariffs.js, a 7-day cache, Public's dependence on Admin's library.