From 644e852cade79dbc19fc01d8eed0fb865eb9ba56 Mon Sep 17 00:00:00 2001 From: wshallwshall Date: Tue, 11 Aug 2026 14:21:12 -0500 Subject: [PATCH] ledger: record the adversarial findings on #1064, #1086 and #1097 -- all three STAY OPEN Three worktree-gate lanes produced ZERO landable commits. All three attempts are local-only and anchored; none is pushed. The findings are recorded here so they are not stranded in session messages. #1086 -- DO_NOT_LAND. Its premise 'a MESSAGE flag's quoted span is DATA' is FALSE for two of the four quoting forms, because POWERSHELL SUBSTITUTES BEFORE GIT IS INVOKED: "a $(1+1) b" -> a 2 b @"..."@ -> a 2 b SUBSTITUTE 'a $(1+1) b' -> literal @'...'@ -> literal INERT Its blanking covered all four, so six verdicts moved DENY -> ALLOW with live payloads, AND it added the executable spelling to the must-ALLOW parametrize -- making the bypass a REQUIREMENT that reds the suite for whoever later restores the deny. The correct rule is narrower and costs nothing: blank only the spans PowerShell cannot substitute. This repo's OWN documented convention for multi-line commit messages is the single-quoted here-string, so the inert form is the house form and the item's original complaint is fully served. #1097 -- the METHOD was right and stopped one dimension short. It replaced the hand-typed prefix list with a generating rule, with genuine red-first both directions. But the SIGIL stayed a hand-typed two-member class, and pwsh --command / --Com / --c all EXECUTE and all bypass rules 3b and 3c. Its banner also claimed 'every prefix from -C to -Command', a false completeness claim that became SDS-3.7 once a control rested on it. #1064 -- four bypasses open, one a REGRESSION the attempt introduced, and the one I would raise hardest: ANY WHITESPACE IN THE REPO PATH DEFEATS RULE 3d ENTIRELY, absolute spelling included. Latent on this box only because the primary path has no space -- and latent by accident of one machine's paths is an unexercised precondition, not a mitigation. It also breaks the attempt's own control row, which weakens its evidence for every other row measured beside it. THE LESSON RECORDED WITH #1086, because it is the general one: all three lanes had excellent PROCESS -- real mutants, byte-identical restores, disclosed gaps, no deleted coverage, no false denies. Every process signal green. RED-FIRST PROVES A CHANGE HAS THE EFFECT IT CLAIMS; IT NEVER PROVES THE EFFECT IS DESIRABLE. Only a reader who does not share the author's premise can test the premise. AND THIS COMMIT MADE THE SAME CLASS OF ERROR ON ITS FIRST ATTEMPT. I opened #1086's amendment with the no-entry sign for emphasis -- which is a _CLOSED status glyph -- and the item read as CLOSED. backlog_status_check caught it immediately: '1 error, every backlog item must declare exactly one status banner'. A glyph's meaning is POSITIONAL and I used one decoratively in the file whose whole alphabet is positional. Swapped for the non-status warning sign. Gates: 488 items each declaring exactly one status; ledger_check clean; doc guards 48 passed. Open 184, unchanged -- all three items stay open. --- docs/BACKLOG.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index 1cadd8ac..db812ff8 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -4496,6 +4496,20 @@ cd ../Unrelated && git -C . config core.hooksPath /dev/null ## 1086. Rule 3c reads a PowerShell here-string as a command, so a commit message that quotes a disarm key is refused > ๐Ÿ”ข **Filed 2026-08-07 โ€” not started. โ›” LIVE ON THE INSTALLED GATE, and it refused the commit that filed #1085.** Value **7/10** ยท Difficulty **3/10** ยท _do it_. `git commit -m @'...'@` whose MESSAGE quotes a disarm command is denied by rule 3c. The hook scans the tool-call text, matches the key, and refuses โ€” though the quoted text is data being passed to `-m` and nothing was ever going to execute. **The gate cannot commit a faithful description of its own defect.** +> โš ๏ธ **AMENDED 2026-08-11 โ€” an attempt was ruled DO_NOT_LAND: it WEAKENED the gate and SHIPPED A TEST PINNING THE WEAKENING.** `95abca70` (branch `claude/g1086`, local only, anchored, **not pushed**). Its premise was *"a MESSAGE flag's quoted span is DATA, not a command"*. **That is FALSE for two of the four quoting forms, because POWERSHELL SUBSTITUTES BEFORE GIT IS EVER INVOKED:** + +> ``` +> "a $(1+1) b" -> a 2 b @"..."@ -> a 2 b SUBSTITUTE +> 'a $(1+1) b' -> a $(1+1) b @'...'@ -> a $(1+1) b INERT +> ``` + +> Its blanking alternation covered **all four**, so **six verdicts moved DENY -> ALLOW carrying live `$(...)` payloads** โ€” and it added `git commit -m @"..."@` to the **must-ALLOW** parametrize, making the bypass a *requirement*: anyone later restoring the deny reds the suite and concludes they broke something. + +> **THE CORRECT RULE IS NARROWER: blank ONLY the spans PowerShell cannot substitute** โ€” `'...'` and `@'...'@`. **That costs nothing legitimate**, because this repository's own documented convention for multi-line commit messages IS the single-quoted here-string (*"use a single-quoted here-string so PowerShell does not expand `$` or backticks inside"*). The inert form is the house form, so covering only the literal spans fully serves this item's original complaint. + +> **KEEP what the attempt got right, and re-verify rather than inherit it:** the flag set must stay a CLOSED enumeration keyed on git's message flags (blanking by SHAPE re-opens the interpreter route-around); the block must run AFTER the recursion handling or its emitted quotes desynchronise a `bash -c` argument; and `c`/`C` must stay outside the flag class so no `-Command` prefix is admitted. + +> **The lane's PROCESS was excellent โ€” real mutants, byte-identical restores, gaps disclosed, no deleted coverage, no false denies. Every process signal was green.** Recorded because it is the lesson: **red-first proves a change has the effect it claims; it never proves the effect is desirable.** A checklist verifies the mechanism; only a reader who does not share the author's premise can test the premise. **Cluster:** Session-drift controls / gate integrity. **Priority:** P2. **Verdict:** build. **Severity:** no product effect and no PHI effect. It blocks the specific act of DOCUMENTING a gate defect, which is a self-concealing failure: the harder a finding is to describe without quoting it, the harder it is to file. @@ -4980,6 +4994,13 @@ The second step's arithmetic is measured: `GetFullPath('.git', )` r ## 1064. Rule 3d assumes its target is a linked worktree, but the primary is a registered worktree too, so removing it by a relative path is allowed > ๐Ÿ”ข **Filed 2026-08-06 โ€” not started, and the RELAYED half is now CONFIRMED (2026-08-06).** The filing below says the `git worktree remove ` ALLOW was relayed rather than measured, and asks that it be confirmed before the severity is acted on. It has been, from the other end and by accident: a non-vacuity control written for the pytest harness's cwd repair (`test_rule_3d_STILL_depends_on_where_the_hook_process_stands`) measures the SAME payload twice, moving only where the hook PROCESS stands. `git worktree remove ../Primary-wt` DENIES when the hook runs where the session is โ€” production, and what the repaired harness now does โ€” and ALLOWS when the hook process stands anywhere else. That is this item's mechanism seen directly: the relative victim is resolved against the wrong base. โš ๏ธ ONE TRAP, MEASURED, because it made the dependence read as ABSENT on the first attempt: if the foreign directory is a SIBLING of the victim, the same relative token resolves to the same place from both, every verdict agrees BY LUCK, and the instrument reports invariance. The control's fixture is nested for that reason. **Nothing about rule 3d was changed** โ€” it shares a resolver with rules 3 and 3b, so a change there must be measured against THEIR controls rather than credited to the rule-3c work. Value **6/10** ยท Difficulty **2/10** ยท _do it_. Rule 3d resolves its victim's common dir with `Get-ComparablePath $victimCommon $victimRaw` (`worktree_gate.ps1:625`) โ€” the **same construct, against the same kind of base**, that #1061 has just been fixed for in rule 3c. `$victimRaw` is the path token as written, so a relative target makes `GetFullPath` throw on a non-fully-qualified base, the catch returns `""`, no governed root matches, and the rule falls through to ALLOW. +> โš ๏ธ **AMENDED 2026-08-11 โ€” an attempt was REJECTED, and it left FOUR bypasses open, one of them a REGRESSION IT INTRODUCED.** `1adda56e` (branch `g1064`, local only, anchored, **not pushed**) was ruled NEEDS_WORK by an independent reader who rebuilt the rig rather than reading the report. Its red-first was genuine and reproduced (11 failed pre-fix), no coverage was deleted (43 -> 56 node ids, `comm -23` empty), and the wider gate family stayed green at 338 passed. **The engineering was sound; the coverage was not.** + +> **THE REGRESSION IT INTRODUCED:** `git -C "" worktree remove ../Repo-wt` from a foreign session cwd now **ALLOWs on the FIXED gate**, in both hook-cwd positions. Still open alongside it: a prefix `cd` is ignored (`cd "" && git worktree remove --force ../Repo-wt` -> ALLOW on both fixed and pre-fix), and indirection defeats it entirely (`p=../Repo; git worktree remove "$p"` -> ALLOW; `git worktree remove "$(echo ../Repo)"` -> ALLOW). + +> **THE ONE TO RAISE HARDEST: ANY WHITESPACE IN THE REPO PATH DEFEATS RULE 3d ENTIRELY โ€” absolute spelling included.** Measured on a rig whose primary is `\Pri mary`. It is latent on this box only because the primary happens to have no space in its path, and **"latent because of an accident of this machine's paths" is not a mitigation, it is an unexercised precondition**. It also breaks the attempt's own control row, which means its evidence for the *other* rows is weaker than it looks: **a control that does not hold undermines everything measured beside it.** + +> **Fix the regression before anything else**, and treat the whitespace case as a first-class requirement rather than an edge case, since a path with a space is ordinary on Windows. **Cluster:** Session-drift controls / gate integrity. **Priority:** P2. **Verdict:** build. **Severity:** no product effect and no PHI effect โ€” this governs agent behaviour in development. @@ -5549,6 +5570,13 @@ it twice per leg). ## 1097. The interpreter recursion list is a fixed set of flag spellings, but PowerShell accepts unambiguous prefixes, so `-Com` hides its argument from every rule > ๐Ÿ”ข **Filed 2026-08-07 โ€” not started. โ›” LIVE ON THE INSTALLED GATE, and it is a FAIL-OPEN, not a wording defect.** Value **8/10** ยท Difficulty **2/10** ยท _do it_. `worktree_gate.ps1:285` recurses into an interpreter argument for a FIXED list of spellings -- `-c` / `-lc` / `-Command` / `/c` / `/k`. **PowerShell accepts any unambiguous PREFIX**, so `-Com` and `-Comm` run code and are not on the list. Their argument is therefore blanked as an ordinary quoted span and its contents are invisible to EVERY rule. +> โš ๏ธ **AMENDED 2026-08-11 โ€” an attempt got the METHOD right and stopped ONE DIMENSION SHORT.** `545f536b` (branch `g1097`, local only, anchored, **not pushed**) replaced the hand-typed prefix list with a **generating rule** (`$word='command'`, prefixes built by substring), with genuine red-first in both directions โ€” 52 failed pre-fix, 76 after, and a widening mutant redding exactly the four bounded cases. **That work is sound and should be built on, not replaced.** + +> **WHAT IT MISSED, proven by driving pwsh 7.6.4:** `pwsh --command`, `--Com` and `--c` **all execute**, and all three ALLOW through rules **3b and 3c** using the branch's own fixtures with only the flag spelling changed (6 failed / 2 passed). **The SIGIL `[-/]` is a hand-typed two-member class inside a fix whose entire purpose was to stop hand-typing enumerations** โ€” and the double dash is the ordinary POSIX spelling on the platform this repo targets, not an exotic one. + +> **Its proposed banner also carried a FALSE COMPLETENESS CLAIM** โ€” *"the missing spellings were every prefix from `-C` to `-Command`"* โ€” which is CLAUDE.md ยง11 / SDS-3.6, and became **SDS-3.7** the moment a control rested on it. Any replacement banner must say what was covered **and state what was not**, preferring *"at least"* to an enumeration. + +> **Scope:** generalise the sigil the same way the prefix was generalised, then **audit the remaining dimensions rather than assuming two is all of them** โ€” sigil, case, prefix length, cluster forms, cmd.exe switch runs โ€” driving real binaries for every claim. **Do not widen into a false deny:** the bound that makes the prefix rule safe is the mandatory `\s+` after the flag, and `-Cm`/`-Cmd`/`-Cnd`/`-Comd` must keep failing it. **Cluster:** Session-drift controls / gate integrity. **Priority:** P1. **Verdict:** build. **Severity:** no product effect and no PHI effect. It is a live route-around of the whole gate: whatever a session may not do directly, it may do inside `pwsh -Com '...'`.