Found by disarming the LIBRARY's clauses rather than the script's. The end-to-end tests only
ever drive the real workflow, which is well-formed, so four clauses could be removed with
the suite still green:
- the plain-login validation that rejects a glob entry
- the sentinel gate that makes `contains` answer CANNOT-TELL instead of NOT-A-MEMBER
- the empty-list check
- the restoration of the caller's `-f` setting after the split
The first is the one that matters. `for x in $list` performs PATHNAME EXPANSION, so a `*`
entry expands to the FILENAMES around it, and any of those matching the plain-login class
would validate cleanly and enter the allow-list as a real reviewer.
`review-verdict-vocabulary.sh` records exactly this happening to its own word list; the new
test stocks the working directory with plausible login names so an expanding implementation
loads a list instead of refusing.
The sentinel one is a wrong-cause defect rather than a fail-open: without it a broken
checkout answers NOT-A-MEMBER, and the script then tells the operator to fix a credential
that is fine.
A note on the measurement, because the first attempt was wrong. The initial disarm of the
plain-login class widened it to `[!A-Za-z0-9._!@#$%^-]`, which still excludes `*` — so it
mutated nothing and the "no test covers this" reading was an artifact of an inert mutation.
The real disarm has to ADMIT `*` (`[!A-Za-z0-9._*-]`), and the probe now asserts that the
mutant class accepts `*` before drawing any conclusion from the run.
All four confirmed to redden their own named test.
fixes#845
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019zUmJZHhVP7kXg5DV237TW
timothyandClaude Opus 5
5f93930a18