timothy
1ef581403c
PR Gates / CI image pin matches docker/ci (pull_request) Successful in 11s
PR Gates / Docs update reminder (pull_request) Successful in 14s
PR Gates / decisions lifecycle (pull_request) Successful in 19s
Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (pull_request) Successful in 1m23s
Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (pull_request) Successful in 29s
Build ErsatzTV Image / Functional E2E (curl + UI contracts) (pull_request) Successful in 6m20s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 21m10s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 21m57s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
Fable's round-5 review ran the 16 tmp_path tests that no prior round could execute (16/16 pass) and mutation-tested every fix. Six of seven reverts were killed; one survived, which is finding 1. 1. The exact-arity refusal in `_token_armed` had ZERO coverage -- deleting it passed all 55 tests, because nothing fed malformed git-log output to that function. Now pinned by a test that stubs `_run` with 2-field and 4-field output and asserts refusal, plus a 3-field control proving the refusal is about arity rather than the token. Verified the new test kills the mutation. 2. `test_integration_separator_in_subject_cannot_inject` did not actually pin the NUL framing: with `\x1f` framing restored and the arity check kept, it still passed, because one or two injected separators break arity and get absorbed. Added a case with THREE separators, which restores a multiple-of-3 arity and would false-arm under that revert -- so it pins the framing itself. 3. The decision record attributed the "old git echoes the trailers atom" case to the arity check. Wrong: an echoed atom is one well-formed field, so arity cannot catch it -- that case is handled by the `git --version` capability probe. Corrected in the record. Not changed: review also noted subject matching is now case-insensitive, so `[DECISIONS-EDIT]` arms where the old substring check was case-sensitive. Deliberate and harmless -- arming still requires typing the token.