17 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
timothy	efadbec297	fix(876): sweep session narrative out of hooks, workflows, scripts, tests and code comments; grow the detector to the process corpus (#906)	2026-09-03 19:26:01 +00:00
timothy	dd0f75f1b6	fix(855): two glob dialects cannot be canonicalised into one, so model one shape and refuse the rest (#902) ... `ci-image.yml`'s `on.push.paths` decides which pushes to `main` publish a toolchain image; `ci-image-pin`'s `git log` pathspec decides what the pin must name. #744 removed the shared self-reference that kept them in step, leaving the agreement carried by three prose comments, and divergence is silent and green in the dangerous direction. The guard derives both lists from the workflow documents and compares them for set equality in both directions. The comparison is deliberately narrow: it accepts a publish entry spelled exactly `<dir>/**` against a pathspec entry spelled exactly `<dir>`, segments restricted to `[A-Za-z0-9._-]`, and raises on every other spelling rather than deciding what that spelling would have selected. That narrowness is the substance. Measured against Gitea 1.27.1's own in-tree compiler (`modules/actions/workflowpattern` -> `modules/glob.CompileWorkflow`) and real git: a bare `docker/ci` in `paths:` compiles to an anchored `^docker/ci` and selects none of the directory's contents while the git pathspec `docker/ci` selects all of them; `<file>/**` matches nothing while the pathspec `<file>` tracks the file; a leading `/` is literal to Gitea while git refuses it outright. A canonicaliser mapping the two dialects onto one string form was built twice and defeated twice, each repair surfacing another spelling, so it was deleted rather than extended per `testing.verification-code-needs-its-own-proof`. The guard also asserts from the git index that each named path really is a directory, since `<file>/**` and the pathspec `<file>` spell the same string; takes the pathspec from the `git log` assignment rather than any `git log` in the job; refuses a `<<` token on a code line (a herestring excluded) and a second bare `--`; and treats an absent and an empty `paths:` alike, because Gitea's `Skip` returns false on an empty sequence, so `paths: []` filters nothing and every push publishes. The docstring states the boundaries rather than implying coverage: the guard compares the pathspec the pin job writes and does not establish that the staleness comparison consumes it, and a descendant whose path below `<dir>` contains a newline is matched by the git pathspec but not by the publish pattern. Verified by nine independent cold-review rounds, none of which found a false green; the last fuzzed 27,720 publish/pathspec pairs against a port of the deployed compiler and real `git ls-files`. fixes #855	2026-08-30 19:25:23 +00:00
timothy	4cd6929735	fix(887): the image build builds the SPA and does not test it (#899) ... `docker/Dockerfile`'s web-build stage ran the SPA vitest suite with two hand-written `--exclude`d spec paths. The stage is gitless twice over, and the suite has members needing a git checkout or the git binary, so that list was a population nothing derives. #883 added a third member without updating it; because `Build & push image (amd64)` is `if: github.event_name != 'pull_request'`, the red was unreachable on a PR and landed on `main` and the `v*` tag path. Every image build has failed since. The list is removed rather than extended: the stage builds the SPA and does not test it, and the suite runs once, unfiltered, in the `test` job that `build` already `needs:`. `scripts/tests/test_image_build_delegates_the_spa_suite.py` holds the invariant in three parts, because the first two together still certify a publish on which the suite never ran. It PINS command text rather than parsing it: three earlier versions asked what a command MEANS and were wrong nine times, and a partial match of `web/vite.config.ts` was then defeated seven more ways, so both mechanisms were withdrawn rather than respelled. The transferable rule, recorded in the guard and the decision record: a pin assumes it is pinning the artifact that still DECIDES. Every route found was authority moving where the pin was not looking — another file, another occurrence, another workflow, or a hook the pinned command invokes. Nine independent cold-review rounds, eight BLOCKED. 73-mutant development battery, 0 missed; one declared clause mutation harness-executed per suite. fixes #887	2026-08-30 16:06:21 +00:00
timothy	4b7ede80b8	Merge pull request 'docs(release): record the v26.15.0 release notes' (#898) from release/v26.15.0-notes into main	2026-08-30 15:25:58 +00:00
timothyandClaude Opus 5	528383cf3a	fix(880): an absent recurrence array means unrestricted, an explicit [] is rejected (#892) ... The three recurrence arrays are read CONJUNCTIVELY by AlternateScheduleSelector.GetScheduleForDate, so an empty set matches no date. `?? []` on an omitted array therefore returned HTTP 200 while storing an alternate-schedule or template item that could never apply, silently -- while the read side (#823) already read a NULL column as the All*() sets. Absent and explicitly-empty are two different requests and get two answers: ABSENT (missing, or explicit null) normalizes to AlternateScheduleSelector.All*(), the same symbols the read side substitutes; EXPLICIT [] is rejected with a 422 naming the consequence, via RecurrenceSetBounds called from both replace handlers. The rejection lives in the handlers, not the controller, because api.ffmpeg-profile-numeric-bounds' "accept an UNCHANGED bad value" rule binds hardest here: both PUT paths are whole-list replaces, so rejecting a pre-existing empty set would make every OTHER item in the list uneditable. That comparison needs the stored row. The validated set is derived from `incoming`, so the highest-Index catch-all -- whose recurrence the handler discards -- is excluded by construction. Verified: full ErsatzTV.Tests suite green; three mutation proofs with disjoint reddened sets; live-E2E against a real instance confirmed an OMITTED property round-trips as unrestricted (the Newtonsoft missing-property chain unit tests cannot reach), an explicit [] returns the 422, and [] on the catch-all is accepted. Cross-family cold review BLOCKED the first implementation with 3 findings, all real and all fixed; re-review returned MERGEABLE. Follow-up #894 filed: the SPA can still build the empty state the server rejects. fixes #880 Decisions-Edit: yes Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-30 09:29:02 +00:00
timothy	58681b3a79	fix(849): the verdict gate replaces every unknown state, and proves the clauses that claim to (#890)	2026-08-30 05:55:09 +00:00
timothy	1afad0851d	fix(823,824): a scheduling NULL collection reads as UNRESTRICTED and is guarded at both read sites; the Elastic indexer gets its own mutation proof (#879)	2026-08-29 19:55:53 +00:00
timothy	609fd852c2	fix(763): page both /statuses/{sha} reads to a validated terminator (#868)	2026-08-28 17:34:48 +00:00
timothy	e8e17f3844	docs(708): record the live route-2 reproduction against PR #761 (#834)	2026-08-26 09:11:23 +00:00
timothy	7966e08164	fix(701): guard SongMetadata's nullable primitive collections at the read site (#826)	2026-08-22 23:24:41 +00:00
timothy	ad31a02850	fix(772,792): name the missing toolchain image; stop a refusal leaving a verdict comment (#825)	2026-08-22 23:05:34 +00:00
timothy	ad0bed4585	feat(778): name the check-and-use race, and verify the protection the merge gate rests on (#802)	2026-08-21 17:04:13 +00:00
timothy	b552e569bb	Merge pull request 'chore(deps): update dependency scriban.signed to 7.2.6' (#762) from renovate/scriban.signed-7.x into main ... Reviewed-on: #762	2026-08-14 15:26:37 +00:00
timothy	f8f2dca2ce	Merge branch 'main' into renovate/scriban.signed-7.x	2026-08-14 13:45:55 +00:00
timothy	945328fa24	feat(774,775): one rule for guard populations, one for guard proofs — both enforced (#791)	2026-08-13 23:17:57 +00:00
timothy	9a5d34e888	fix(751): a stray expression delimiter in a COMMENT killed the verdict gate (#764) ... The classify step in review-verdict.yml stopped executing on 2026-08-03 and the job reported success anyway, so the branch-protection-required review-verdict/h10 was posted by nothing but a human hand for three days and both exemption classes silently died. Three independent defects, each alone sufficient: * A ${{ }} sequence in a SHELL COMMENT. The runner scans the whole run: scalar for the expression opener and rewrites the entire body into one format(...) call; `pr number` does not parse, so it drops the step and concludes the job green. The prose documenting a fix disabled the fix. * The retarget fence never trusted its count: a page past the end of the timeline is JSON `null`, not `[]`, so rt_ok was never yes for ANY PR and every exemption success was withheld. Fixing the first alone would not have restored the exemptions. * The same nil-slice shape on /commits/{sha}/status, which made read_existing_verdict exit 1 and post nothing. A nil Go slice serialises to `null`, so every list-shaped field on this API is suspect and only a per-endpoint measurement settles it — timeline returns bare null, the combined status returns {"statuses": null}, comments and pulls/{n}/files return [], and /statuses/{sha} returns []. Four endpoints, three shapes. The silent green is the actual defect, so a start-marker guard now fails the job when the classifier did not execute, and two static guards reject the delimiter at review time. CLAUDE.md and AGENTS.md became PROTECTED paths: they define the H10 rule and were docs-only-exemptible, reachable again precisely because this restores the exemptions. Verified by a live scratch-base probe pair with a negative control, 460 tests, and 29 mutations across six rounds. Five cold review rounds, alternating model families; none found a path to a green review-verdict/h10 on an unreviewed head, and every one found a defect beside the fix — including that round 2's guard was dead code against a page limit of 100 on a server that caps at 50. Deferred: #756 (docker-build's required jobs, where a dropped step is fail-OPEN) and #763 (paging both /statuses/{sha} reads). fixes #751	2026-08-10 19:33:33 +00:00
timothy	3aed43c6de	fix(743): make review-verdict/h10 unskippable — disable direct push to main + admin force-merge; fix(719) tag-only push (#749)	2026-08-05 22:58:16 +00:00