From 409bf23e6a235d6aec367b1ca4e686830160d22d Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Fri, 31 Jul 2026 17:52:42 -0500 Subject: [PATCH] =?UTF-8?q?docs(remediation):=20bank=20D-10=20=E2=80=94=20?= =?UTF-8?q?the=20queue=20guard's=20failure=20modes=20are=20inverted?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same required gate, both directions wrong: fails OPEN on state=unknown (5 meaningless greens this session, wrong branch too), and fails CLOSED on credential resolution, hard-blocking a worker's completed work. The identical command succeeded from that worker's own worktree in another shell, so the checkout was fine. A gate that waves through unchecked work and blocks ready work has its failure modes backwards. Availability failures must degrade to a loud, audited CANNOT_ASSERT; correctness failures must block. Also the Pi-brick shape: a gate whose unavailability prevents recovery from it. RM-03 extended to a third requirement: distinguish CANNOT_ASSERT from ASSERTED_NOT_READY, both registered with must-fail controls, neither exiting 0 silently. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/TASKS.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index fa0b27ed..c463f25b 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -93,6 +93,33 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI. Three independent live instances in a single session — format gate, agent context reset, queue guard — is the class confirmed, not anecdote. +### D-10 — the queue guard's failure modes are exactly backwards + +`ci-queue-wait.sh` — a **required** pre-push/pre-merge gate — was observed this session doing both of +these: + +- **Fails OPEN on an unknown result.** `state=unknown ⇒ exit 0`, five times, during real pushes and + real merges. It also evaluates `branch=main` rather than the branch being acted on. +- **Fails CLOSED on credential resolution.** In a worker seat it aborted with + `Gitea token not found`, hard-blocking a legitimate push of completed, tested work. The worker + correctly stopped (Constitution gate 8). The identical command run from that worker's _own worktree_ + in another shell succeeded, so the checkout and remote were fine — the difference was the worker's + process environment. + +**A gate that waves through work it never checked, and blocks work that is ready, has its failure +modes inverted.** Availability failures (cannot reach the provider, cannot resolve a credential) +should degrade to a loud, auditable _inability to assert_ — never to a hard stop on delivery, and +never to a silent pass. Correctness failures (unknown, malformed, terminal-failure) are what must +block. + +This is also the **Pi-brick shape** (P-RECOVERY-001): a gate whose own unavailability prevents the +work needed to recover from it. + +**Requirement on RM-03, extending its existing two defects:** the guard must distinguish +`CANNOT_ASSERT` (credential/transport/provider unavailable — loud, audited, does not silently pass and +does not permanently block) from `ASSERTED_NOT_READY` (a real non-green CI state — blocks). Both are +registered R-002 cases with must-fail controls; neither may exit 0 silently. + ### D-9 — the comms path shell-interprets message bodies (injection-shaped, found by accident) Sending a status message with `agent-send.sh -m "...`backticks`..."` caused bash to **execute** the