9 Commits

Include renames

Author	SHA1	Message	Date
timothyandClaude Fable 5.1	81358dec5a	docs(901): the acceptance hole belongs to the REJECTED splitter, so the clause claiming a second one is deleted ... `dc3f158bc` corrected a false universal ("this arm's errors are refusals, never acceptances") and, in the same sentence, appended a second unmeasured fail-direction claim: "and the `split(\"\\n\")` residual below is the second acceptance of the same kind". That clause inverts the paragraph it points at. MEASURED, by loading the module and calling its own primitives with `CANONICAL_SINK_ASSIGNMENT + \x0c + "rm -rf /tmp/nothing"` on one physical line followed by `CANONICAL_SINK_SOURCE`: instrumentation_faults(...) -> "the sink preamble is not the canonical two lines" splitlines() selection == [CANON, SOURCE] -> True (ACCEPTS) split("\n") selection == [CANON, SOURCE] -> False (REFUSES) The shipped `split("\n")` refuses exactly where the rejected `splitlines()` accepts, which is what the pre-existing paragraph six lines below already says. There is no second acceptance below; the acceptance belongs to the alternative that was NOT shipped. `\x0c` is not a line terminator for bash either, so `split("\n")` matches the shell the checker models and has no hole of this kind. The FIRST half of the sentence stands and was re-measured: a hook carrying the two canonical lines plus `v="ETV_HOOK_FIRE""_LIB=/tmp/evil.sh"; eval "$v"` produces no preamble fault, so the selector really does accept a writer that never spells the literal. Answered by SUBTRACTION per the brief: the sentence ends at "not all refusals." and no replacement prose is written. `dc3f158bc`'s message argues from the same inversion ("the comment already conceded an acceptance hole of the same kind six lines later"); that half of its reasoning is withdrawn here. Its correction of the universal is unaffected — the selector escape it names is structural and independently measured, above. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 19:05:31 +02:00
timothyandClaude Fable 5.1	20875b0ca7	docs(901): answer round seven by SUBTRACTION — the thesis loses both absolutes, the list loses two copies ... Round seven's blocker was the record's own thesis sentence, and the fix is to delete rather than to re-argue. Six rounds each replaced a refuted absolute with a fresh one; this one states only what was measured. THE THESIS (body). Struck: "a pin cannot be defeated by a respelling of what it COMPARES" and "nothing [stays exposed] for a whole-file pin". Both are false for the record's own worked whole-file pin — measured against the guard's own primitives: _normalise_lines("const flag = '--run --reporter=x';") == _normalise_lines("const flag = '--run --reporter=x';") -> True _normalise('RUN npm ci && echo "a b"') == _normalise('RUN npm ci && echo "a b"') -> True Both pairs differ in bytes and both are respellings of what the pin compares. `PINNED_VITE_CONFIG` — the pin the record calls "pinned WHOLE" — is compared through `_normalise_lines`, so its normalisation is a second exposure axis beside the selector's. The record already refuted itself twice: `rule:` ends "A pin also declares its NORMALISATION and what the normalisation cannot see", and `mechanics:` says the whitespace collapse "including inside a QUOTED STRING" belongs to both TEXT pins. What replaces the sentence is the fail DIRECTION alone — a pin's is a false RED, a shape-matcher's a false GREEN — plus the declaration obligation the rule already carries. No new universal is written in its place. MECHANICS. "named once so the checker, the mutation proofs and the hooks cannot come to mean different strings" is deleted, not repaired: the assignment string is written out at THREE sites in `test_hook_fire_log.py` (measured by walking the AST and comparing each assembled string to `CANONICAL_SINK_ASSIGNMENT` — the constant, and the `current` local of `test_an_ENV_VAR_resolved_sink_path_is_DETECTED` and of `test_the_NEXT_env_var_to_be_invented_is_DETECTED`). The source comment making the same claim is corrected in place, and its correction is STRUCTURAL: it names the three sites and the `current in text` assertion each proof carries, and asserts no mutation outcome, because "an edit here faults loudly there" would be a `CLAIMS` entry under `testing.mutation-claims-are-executed` — wherever it is written — or it is not written. Same reason `4d5bd0dbb` removed the outcome claim from `mechanics:` rather than binding it. THE QUALIFYING-GRAMMAR LIST now exists once, in the record's `rule:`. `docs/README.md` and `docs/guard-inventory.md` state the operative test — an artifact with a grammar the predicate does not implement — and point at the record. The copies had already disagreed inside the commit that wrote them: `docs/README.md` carried five of the six members, omitting JSON5, which is the member the issue's own correction comment names as the one the narrow "shell or config TEXT" framing would have let through (`dont-keep-a-copy-of-a-set`, #869). Rider 1 drops its copy of the vite `DEFAULT_CONFIG_FILES` ordering the same way, deferring to the dated reading in the `test_image_build_delegates_the_spa_suite.py` row. Gate: `pytest scripts/tests -q` 1599 passed, 3 skipped (all pre-existing by-design skips); `decisions_validate.py` OK with the record off the >60-line list; catalog regenerated with no diff; ruff clean; `check-doc-narrative --diff origin/main` 0 warnings. Refs #901 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 18:38:20 +02:00
timothyandClaude Fable 5.1	dc3f158bcb	docs(901): #885 merged, so the sentence the record's structural fact refutes is corrected at its source ... `scripts/tests/test_hook_fire_log.py:154` ended "this arm's errors are refusals, never acceptances". That is false for the SELECTION, which is the half this branch's record is about: `mentions` is chosen by the literal `ETV_HOOK_FIRE_LIB`, so a writer of that variable which never spells the literal is outside the compared set altogether, and the checker never sees it. The comment already conceded an acceptance hole of the same kind six lines later, about `split("\n")` versus `splitlines()`, so the universal was contradicted inside its own block. The correction stays STRUCTURAL — it reads the selector one line below and says what the selector reaches — and makes no claim about what a mutated hook would return. An outcome claim would be a `CLAIMS` entry in `scripts/tests/mutation_manifest.py` or nothing, per `testing.mutation-claims-are-executed` as amended by #881, which is the same reason `mechanics:` states the selector rather than a measured result (`4d5bd0dbb`). WHY THIS LANDS NOW: #885 closed while this branch was in review (merged as #919, `c30847204`), which frees `scripts/tests/`. Of the two obligations `47619320e` recorded as owed, that message is superseded here: - DISCHARGED: this one, inline, above. - NOT OWED, and the reason is not the blocker: the `CLAIMS` entry for the hook-preamble selector. `4d5bd0dbb` removed the outcome claim from `mechanics:` rather than binding it, so the record asserts no mutation outcome and the rule it invokes has nothing to bind. Re-adding a claim in order to bind it would reverse a review-mandated change; an executed GREEN entry (target `.claude/hooks/decisions-guard.sh`, clause = the canonical sink assignment, replacement = that line plus the `eval` spelling, plus the mandatory `reach_replacement`/`reach_expect`) remains available as an ENRICHMENT of the structural fact, and belongs to whoever wants the fact executed rather than argued. Rebased onto `366a0f904..c30847204` on the way: the `docs/guard-inventory.md` conflict is two rows, resolved by taking #885's newer `test_workflow_persist_credentials.py` row (it gained a second invariant) and this branch's `test_image_build_delegates_the_spa_suite.py` row (it dates the vite `DEFAULT_CONFIG_FILES` reading to 8.1.3 and to the lockfile). `docs/decisions/README.md` regenerated, not merged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV	2026-09-05 16:01:18 +02:00
timothyandClaude Fable 5.1	a7d91bf15a	fix(876): sweep session narrative out of hooks, workflows, scripts, tests and code comments; grow the detector to the process corpus ... `docs.no-session-narrative` reaches every durable artifact, but its detector scanned only `docs/**/*.md` and root markdown, and nothing had ever swept the rest. The issue named four sites from one grep and called them a floor. Deriving the population instead — a whitespace-joined sweep over every tracked file outside the detector, for the detector's own phrasings plus the attribution and review-round class #812 found — gave 453 sites in 108 files at `fb5592971`, and a second pass for phrasings the first list missed (hyphenated `round-N`, "an earlier version", "the reviewer proved") added residuals in the same files. Every site was classified with #812's three dispositions (CUT / SEVER / KEEP with its sub-kind) under the who-benefits test; the per-site manifests are on the PR. The rejected designs, tested-and-rejected fixtures, measurements and traps stay; the attribution of who found them and the round in which they were found go. The detector's population grows to `.claude/`, `.gitea/`, `.husky/` and `scripts/` regardless of extension, minus the detector and its own test (whose fixtures ARE the phrasings) and minus `scripts/tests/fixtures/` (test data, including decision-record copies — the same reasoning as the records' own exemption, and what keeps the record's depth measurement true), and `--all` lists tracked REGULAR files only — a symlink's content is its target and a gitlink has none. The #812 argument for leaving `docs/superpowers/**` in the population runs the other way here: `--diff` sees only ADDED lines, and 287 of the 453 sites were under 30 days old — this corpus is where narrative is being added, so the advisory nudge has reach. Density agrees: 56 line-mode hits over the 113 regular files the predicate admits, against 9 over 66 docs files before #812. `web/` and C# stay out on the same measurement (3 of 74 PATTERNS-matching sites, ~4,600 files). The predicate did not grow: PATTERNS matched 74 of 453 sites, and widening the word list to the attribution class is the treadmill the withdrawn parity test ran on. The population oracle is restated over segments with the new arms, the synthetic cross product gains the process heads and non-markdown extensions, a fixture witnesses that a tracked symlink is neither scanned nor counted, a `.py.bak` axis separates a by-name exemption from a `startswith` over the same tuple, and eight mutants (drop the process arm, drop the by-name exemption, exempt by `startswith`, drop or add a prefix, drop the fixtures exemption, list only markdown, drop the symlink filter, test the mode per row instead of per path) each redden it. A pre-existing silent drop in `--diff` goes with it: git tab-terminates a `+++` filename that contains a space, and the kept tab made `is_scanned_path` refuse the file with no notice — fixed, with a positive control and its own mutant. Code is unchanged by construction, measured per file type against `origin/main`: Python modules are AST-equal with docstrings stripped, except `#` lines inside the embedded fixture programs (string literals) of three test modules; workflows differ only in `#` lines inside `run:` block scalars; shell, C#, TypeScript and jq are equal with comment lines stripped. The stated exceptions: the detector and its test, 26 vitest titles that carried review-round or severity labels or a reviewer attribution (call sites whose title changed — every changed title line walked back to its `it(` / `it.each(...)(` anchor, so a `' + '` concatenation counts once), two registry note strings and the mutation manifest's prose fields. scripts/tests: 1565 passed. Web: lint, typecheck, 1319 tests green. Closes #876. Decisions-Edit: yes Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PEcBoFw7ctrf3Nb7R7x7wk	2026-09-03 20:51:39 +02:00
3 people	8fd9eae0bf	fix(891): a sourced path is code, so every hook resolves it from its own tree (#903) ... Every hook under `.claude/hooks/` assigned `ETV_HOOK_FIRE_LIB` from `${CLAUDE_PROJECT_DIR:-<self>}` and then `. `-SOURCED it. Sourcing is execution, so a file of that name in an env-designated tree ran as code inside the hook before stdin was read and before it could decide anything. Measured on the merge gate before #858 fixed that one hook: a decoy tree's copy printed an `allow` and exited 0. Reachable without an attacker, because husky is a different launcher: `.husky/pre-push` invokes `./.claude/hooks/…` relative to the PUSHED tree, independent of the variable, so a push from one worktree while the environment names another sources the other tree's code into a gate. Sweeps the remaining twelve hooks together (population derived from `git ls-files`), reconciles the second resolution inside `scripts/hook-fire-log.sh` itself, and requires the root to OWN the sink (`-ef`, not `-e`). The static guard pins the preamble BYTE-FOR-BYTE — a withdrawal, after a lexical rule was defeated by five successive shapes. Also pins two arms of the checker that were unsubsumed AND unpinned: the begin call's presence and its missing stdout-mode token. `…_LOSES_its_instrumentation_…` looked like their proof and was not — it asserts only that the fault list is non-empty, and a stripped hook trips four arms, so deleting either left the suite green. fixes #891 refs #858, #859, #776 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UYNbVwgVszv6Pum7ZuGd75 Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-30 21:41:19 +00:00
timothyandtimothy	b6b3520bdb	fix(809,822): isolate the suite from the production hook-fire log by construction (#874) ... Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-29 02:32:26 +00:00
timothyandtimothy	29d7a06e65	fix(806): guard populations over FILES derive from the git index, not a filesystem walk (#818) ... `testing.guard-derives-population-from-source` (#774) was silent on the commonest population in our own guards — files in a directory — and every one answered with a filesystem walk. A walk is not authoritative: it reports build output, generated shims and editor droppings, and differs per machine. #778 measured the cost by getting the same population wrong three times in one PR. CONVERTED (a completeness claim over tracked files): `test_guard_inventory.py`, `test_hook_fire_log.py`, `test_ci_image_pin_population.py` (which also gained `*.yaml`), `test_remote_state_inventory.py` (folded onto the shared derivation), and `test_pr_changed_files.py` (not on the issue's list — found by sweeping the whole repo). ASSESSED AND RECORDED, not silently skipped: `_repo_copy` takes its file list from the index for hermeticity though it makes no completeness claim; `test_ci_dropped_step_guard.py` has no filesystem population at all; the decisions corpus is recorded as unexamined rather than cleared; and the SPA page-size guard is deferred to #819 with its obstacle documented. This is not "replace every glob". `scripts/tests/tracked_files.py` is the single derivation. `test_guard_populations_derive_from_git.py` proves it in two measured complements: exhaustive removal catches a hardcoded `.exists()` admit and memoisation; the call log catches an append-only source that yields nothing on this machine — #778's shape — which removal cannot see because it has nothing to remove. Twelve rounds of independent cold review, alternating model families in isolated worktrees. The production derivations were confirmed sound every round; every blocking finding after the first was in the proofs or in prose claims about them. Counts over growing populations were removed rather than corrected, after three drifted. fixes #806 Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-22 16:07:58 +00:00
timothyandtimothy	d4c72697f2	feat(780): commit a ruff config and enforce it in CI (#813) ... Python lint here was a property of the operator's laptop: the global instructions say to run ruff, no workflow ran it, and with no committed config ruff fell back to whichever ~/.config/ruff/ruff.toml the machine happened to have. - ruff.toml at the root, pinned ruff==0.12.11 in the script-tests job. - Both lint steps pass an EXPLICIT population from `git ls-files` with `--no-force-exclude`, never `ruff check .` — an `exclude` empties a discovery-based run into a GREEN one (top level empties both commands, [lint] empties check, [format] empties format --check), and `ruff check .` over zero files exits 0 with only a stderr warning. Guarded by an empty-population arm. - Tree clean: 74 findings at 706674272, 57 fixed in code, 17 per-site noqa with reasons inline. S105 deliberately per-site, not a directory blanket. RUF100 selected so a suppression that suppresses nothing is itself a finding. - pyright stays ungated; reasoning in the record. Both steps witnessed red on the runner against the shipped bodies: run 2173 job 9176 (ruff check) and run 2170 job 9163 (ruff format --check). Docs: new record ci.python-lint-ruff-config-committed, ci.script-tests-job cross-ref, docs/ci-cd.md (also correcting a stale ~190-tests/~10s figure to the measured 773 tests / ~4.5 min), docs/defect-shapes-773.md §5.2 resolved. fixes #780 Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-22 00:33:18 +00:00
timothyandtimothy	499dd348ab	feat(776): every hook reports that it fired, and the report is measured (#795) ... Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-14 19:11:05 +00:00