forked from mosaicstack/stack
Jason WoltjeandClaude Fable 5
fb3c3c348f
The _has_hard_locator gate tested only repo+issue / 40-hex sha / file — the forge locator vocabulary. detector.sh (A1) builds board_file locators as kind/id/observed_hash + path (+ snapshot_sha/_ts when attested, #940): zero keys in common, so a class=actionable board_file entry could NEVER pass and every heartbeat-planning delta dead-lettered (live seqs 63/68, dragon-lin, 2026-07-30). Latent since #920; the #920 harness pinned the detector pilot shape as its malformed example, ratifying the gap. Fix: `path` becomes a hard-locator arm — and ONLY path. It carries the same one-call re-verify precision as `file` (re-read <path>; upgrades to git show <snapshot_sha>:<path> when snapshot-attested). Deliberate NON-arms: observed_hash (content hash, not an address) and bare path-less snapshot_sha (would widen the gate past the board_file vocabulary — review-adopted criterion). Quarantine is a render-time filter (entries never leave pending.jsonl; dead-letter.jsonl is ledger + alarm-dedup only), so existing UNCONSUMED dead-letters re-deliver automatically on the first post-upgrade drain. Consumed-past dead-letters are not requeued. Tests: Q11 positive control renders the live seq-68 entry VERBATIM as CLAIM@seq (real detector emission, not a hand-built dict); negative controls assert address-free and bare path-less snapshot_sha siblings still quarantine — the snapshot_sha control at all THREE lengths the detector's attestation validation ^[0-9a-f]{7,64}$ admits (7-char abbreviation, 40-hex, 64-char sha-256), so it distinguishes "no arm" from "arm present but length-gated" (review finding E1). Q1/Q6–Q9 fixtures moved off the now-valid path-bearing shape. RED at base: exactly the 8 Q11 assertions fail; Q1–Q10 pass under both digests. Closes #944 Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB Written-by: pepper (sb-it-1-dt)