Lavern — Agentic Law Firm (67 Specialists)

No reviewer summary was written for this build.

First TalentDelta packaging at pinned commit 526a3b833705 (2026-09-05). Upstream paths deliberately NOT shipped: viz, site — the upstream marketing site and visualisation bundle (about 42 MB), regenerable and the reason the archive exceeded the 20 MB upload ceiling. Every other file is byte-identical to the pinned commit, a provenance record is appended to README.md, and the packaging secret scan found only sample values (one unit-test JWT fixture, placeholder env defaults), no live credential. The eval fixtures themselves are excluded (see the exclusion note): they are public SEC filings carrying third-party contact details, and remain re-fetchable from CUAD/EDGAR by anyone re-running the eval.

Review: Decision: APPROVED — lavern-agentic-law-firm v1.0.0 ([internal reference removed]), decided 2026-09-30 19:41:47Z Uploader / notice recipient: [internal reference removed] — the file's only credit (position 0, role 'scouted') and the version's uploader, so the two agree; the address is internal (@talentdelta.ai), which the notice path skips by design, so no external party is mailed. WHAT WAS CHECKED, AND HOW - Bytes: fetched from our own store (scripts/review-lane/blob-fetch.cjs) by the stored object hash, not through the customer download door. sha256 81d2e6293cb1c3aebe48a40635703619e98c5efc2eb73387178f70de9103744d · 2,771,259 B — matches FileVersion.blobId→Blob.contentHash and the uploaded size exactly. - Provenance, verified by fetching the commit rather than trusting the pack: the tree was compared path-by-path and byte-by-byte (git blob sha1, mode + content) against a clean clone of AnttiHero/lavern sitting at the disclosed pin 526a3b833705. Result: 559 files identical, 1 differing (README.md), 0 added, 1312 not shipped. The pinned clone's HEAD is 526a3b833705, matching the pin named in the change note and the README append; zero symlinks ship. - The one differing file is README.md, and the difference is purely additive: upstream's README text is a byte-prefix of the shipped file, whose extra bytes are the appended provenance record (upstream URL, licence, pin, runtime note, and the list of what was not shipped). - Removals are exactly the disclosed set: the ten raw eval fixtures `evals/jv/*.txt` (SEC filings), the marketing site (`site/`) and the visualisation bundle (`viz/`). Every not-shipped path falls inside those categories; zero undisclosed removal. - Licence: Apache-2.0 — Antti Innanen (2025-2026), NOTICE + AUTHORS shipped, dataset attributions in NOTICE. Licence text ships; the terms match the claim. - Taxonomy: 4 skill slugs, all storable leaves: business_professional/legal/{contract_review,legal_research}, ai_ml_engineering/agent_orchestration/{multi_agent_coordination,negotiation_resolution}; domains legal/contract_law, legal/corporate_governance — each verified against the pinned snapshot apps/web/src/lib/taxonomy/oasf-1.1.0.json (tag v1.1.0, commit f510be0d4b58, 513 skills / 201 domains): node exists, category=false, no children. - Secrets: the lane's own packaging reader plus an independent secret-shaped scan over every text member. No live credential. Findings and adjudication: * Reader verdict BLOCKED: 9 blocking, 2 real findings among them. Seven are `/home/user` fixture strings inside `tests/unit/api-validation.test.ts` (cases for a path-safety function) — upstream's own test data, not a packaging leak. One is the word 'Node.js' in a runtime line (the reader's command heuristic), one is the README's remote installer `curl -fsSL lavern.ai/install.sh | sh` (a documented remote bootstrap; the archive ships `setup.sh` and `docker-compose.yml` as the local routes). * Record-accuracy gap, recorded and not treated as a hold: the ten raw fixtures were dropped because they 'reproduce third-party SEC-filed contracts … containing named individuals' contact details', but the *kept* run records (`evals/jv/runs*/**.jsonl`, 56 files) and `_score-v2.json` still quote the same filings — 10 phone-shaped and 95 postal-address-shaped matches plus party names (Veoneer/Nissin and others). All of it is public EDGAR/CUAD material, the note itself says it 'remains re-fetchable from CUAD/EDGAR', and the pack's NOTICE carries the dataset attributions, so no licence or privacy obligation is unmet; the note simply does not say that the kept reports carry that material too. * 10 reader WARNs are the README's eval table naming the ten removed fixture files — the disclosed removal, with the re-fetch path stated in the change note and the append. * Counts verified: 67 prompt files, `setup.sh` (the one-shot installer), QUICKSTART, rubric and eval reports, seed script — as the summary states. No SKILL.md: this is a Node/Docker application pack, not a skill pack. WHAT I COULD NOT CHECK - The live install-test (an unattended run through the download door on a test identity) was not run for this pack; the byte read proves packaging, not that the pack does its job on a stock host. - Delivery: the decision notice goes to an internal address, which the platform skips by design (skipped=internal_recipient) — there is no external recipient to confirm receipt. VERDICT: approved. The bytes are upstream's at the pin, the removals are the disclosed ones, the licence and taxonomy check out, and nothing private, client-owned or live is in it. (2026-09-30)