fix(docs): unbreak main — six new mirror-prose hits from the master test plan - #161
Merged
Conversation
…est plan main has been red since 4ea1501 (#60): test_cutover_slug_rot's prose ratchet reports 58 hits against a ceiling of 54, so every PR current with main inherits the failure, #160 among them. Measured rather than inferred. The last green commit 8e6e7fa sits at 52 hits with 2 slots of slack, so #60 added SIX — not the four the ceiling arithmetic (58-54) suggests. c5ae1f8 (#96) added none. All six are in the new master-test-plan chapters, and the assertion's "New or changed" list is a tail slice of the sorted hits, not a diff, so it does not attribute them. Five are false positives in senses unrelated to the retired public mirror: three are `the mirror` matching INSIDE "the mirrorED" (the webview functions mirroring stepsModel, ADR 0108), one is a pip wheelhouse for air-gapped installs, and one is a detector spec quoting the very string it wants deleted — the _SELF collision this module already documents, reappearing in another file. The sixth is genuine rot. "the mirror-only gap" reincarnates the nightly cost lever that f7a337a (#25) swept from three files, leaving an explicit "do not re-add it" marker; windows-service-smoke is gated `github.repository == 'MEFORORG/MessageFoundry'`, i.e. ON this repo, which is the source. The line now names that gate instead of a mirror. The regex is deliberately NOT changed. Adding \b to `the mirror` clears three of the six and measures safe on the baseline (52 -> 52, suppressing only the three "mirrorED" lines) — but `private repo` -> "reporting" was a CROSS-LEMMA collision where \b removed noise, whereas `the mirror` -> "the mirrored" is the same lemma inflected, where it removes signal. Measured: \b blinds all five of "the mirrored workflows are rewritten by publish.ps1 on every push", "the mirroring job publishes ... nightly", "the mirrors are refreshed from the source repo each night", "CI runs on the source; the mirrored copy is read-only" and "the mirrored README is regenerated at release time", none of which carries a retrospective trigger — while both KEEP-class probes (the "mirror image of" idiom, a historical narrative) survive it untouched. Those verb forms are how a present-tense mirror claim actually gets written, so the boundary would preferentially blind the FIX class. Filing down the detector to clear a red is the failure this module exists to name. _PROSE_CEILING is unchanged at 54. The count returns to 52 — exactly the last-green posture — so no credit was earned to spend, and lowering it to 52 would set slack 0 as a new, stricter policy unrelated to this fix. Verified: 4/4 in the module; 52 hits / ceiling 54 / slack 2 across 1503 files; ruff check + ruff format clean; full suite 10222 passed, 836 skipped, with the sole failure test_gate_installed_parity — a local-machine test that skips on CI, whose installed-vs-source delta is one redacted comment line. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wshallwshall
enabled auto-merge (squash)
August 3, 2026 21:19
…(3 HIGH advisories) npm-audit (a required gate) began failing on every fresh CI run: three HIGH advisories now cover the ide/ transitive deps at their locked versions — fast-uri (GHSA-7p8r-x3mc-p8w7), undici (GHSA-8xcm-r25x-g524 + siblings), and brace-expansion (GHSA-rgw5-rvv9-x895). Each has an in-major patched release, so this is a lockfile bump, not a breaking major: fast-uri ^3.1.3 -> ^3.1.5 brace-expansion ^5.0.8 -> ^5.0.9 undici (new override) ^7.29.0 npm audit --package-lock-only now reports 0 vulnerabilities. Folded onto the main-unblock branch so one merge clears both the slug-rot test-red and npm-audit (the two were a circular deadlock).
…69247) pip-audit (a required gate) flagged cryptography 49.0.0 for CVE-2026-69247 — a PKCS7 decrypt Bleichenbacher/timing oracle, fixed in 50.0.0. The straight bump was gated by pyOpenSSL's cryptography<50 cap; pyOpenSSL 26.4.0 lifts it to <51, so both move together, within the existing pyproject floors (cryptography>=48.0.1, pyOpenSSL>=26.3.0) — no constraint change. Re-locked via uv and re-exported all six DEP-1 artifacts (uv lock --check clean); the stale pyproject <50 note -> <51. The advisory's primary oracle is already mitigated on the OpenSSL 3.2+ wheels this project ships; this clears the flagged version regardless. Third and final red gate on the main-unblock branch: with the slug-rot ratchet and the ide npm advisories, one merge now clears all three.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unbreaks
mainon BOTH of its red gates (a circular deadlock)mainwas red on two independent required gates, and each single-issue fix was blocked by the other:1.
testlegs — the slug-rot ratchet. Red at the tip since4ea15017(#60):tests/test_cutover_slug_rot.py::test_present_tense_mirror_prose_does_not_grow— 58 mirror-prose hitsvs a ceiling of 54. Fixed by six lines of documentation prose across three
docs/testing/master-test-plan/*.mdfiles — zero test changes, detector byte-identical,_PROSE_CEILINGunchanged — restoring the last-green 52 / 54 posture.2.
npm-audit— three HIGH advisories now cover theide/transitive deps at their lockedversions (
fast-uriGHSA-7p8r-x3mc-p8w7,undiciGHSA-8xcm-r25x-g524 + siblings,brace-expansionGHSA-rgw5-rvv9-x895). Each has an in-major patched release, so this is a lockfile bump, not a
breaking major:
fast-uri ^3.1.3→^3.1.5,brace-expansion ^5.0.8→^5.0.9,undicinew override^7.29.0.npm audit --package-lock-onlynow reports 0 vulnerabilities.Both fixes are folded into this one PR so a single merge clears both gates and unblocks the queue
(#160, #162 rebase behind it). Docs-only + a lockfile bump; no BACKLOG #N implemented.