ersatztv

timothy/ersatztv

Fork 0

Files

T

History

timothyandtimothy 469d19852c

Build ErsatzTV Image / CI toolchain image resolves (push) Successful in 6s

Details

Build ErsatzTV Image / Delimiter ban (release path) (push) Successful in 25s

Details

Build ErsatzTV Image / Build & test (.NET) (push) Successful in 8m34s

Details

Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (push) Successful in 6m17s

Details

Build ErsatzTV Image / Functional E2E (curl + UI contracts) (push) Successful in 5m50s

Details

Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (push) Skipped

Details

Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (push) Skipped

Details

Build ErsatzTV Image / Build & push image (amd64) (push) Successful in 4m22s

Details

fix(788): one declarative H10 verdict vocabulary, derived by both sides (#846 )

The verdict words lived in two hand-written shell copies — the `case` arms of
post-review-verdict.sh (write) and the POS_RE/NEG_RE regexes of
check-review-verdict.sh (read) — held together by nothing but a comment that had
already gone stale. scripts/lib/review-verdict-vocabulary.sh now declares them
once and both sides derive; neither script enumerates a verdict word any more.

Only the WORD SET moved. The grammar stays in check-review-verdict.sh, where
every #629 false-open actually lived.

No parity test: #774 shipped one and withdrew it after six rounds, because a
regex over shell source is not a shell parser. The proof is behavioural and
graded MUTATION — the harness restores the pre-#788 hardcoded POS_RE each run and
requires it to redden.

Enforcement is a DATA dependency, not a control-flow gate. Review round 1 found a
real fail-open in the first commit: `${#arr[@]}` is nounset-safe only for a
declared-empty array, and under `set -u` that error inside a function called as
`if ! validate` skips BOTH branches — so on the reader (deliberately no `set -e`)
an explicit BLOCKED @ head classified `positive`, exit 0. Validation now sets a
sentinel on its last line and the derived views refuse without it.

Six cold review rounds; rounds 2-6 found no fail-open across differential fuzzing
(4788 / 2612 / 7560 payloads, zero divergences from origin/main's grammar),
sentinel forgery, environment poisoning, declare -p evasion on bash 5.3 and 3.2,
path/symlink resolution and probe TOCTOU. Every malformation fails closed: reader
exit 2, writer exit 1 with nothing posted.

Also corrected: CLAUDE.md and release.review-verdict-gate both enumerated the
vocabulary without LGTM, a word the code has accepted since #629.

fixes #788

Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>

2026-08-26 20:58:09 +00:00

fixtures

feat(610): split the decision corpus into one YAML-frontmatter file per record

2026-07-25 19:45:09 +02:00

__init__.py

feat(521): decision-record parser (decisions_lib)

2026-07-21 02:58:58 +02:00

conftest.py

feat(780): commit a ruff config and enforce it in CI (#813 )

2026-08-22 00:33:18 +00:00

mutation_harness_lib.py

feat(790): execute every MUTATION grade instead of asserting it (#815 )