mosaicstack/stack
1
0
Fork 1
Code Issues 139 Pull Requests 5 Actions Packages Projects Releases 15 Wiki Activity

docs(remediation): bank D-33 — the full-step-scan tool prunes a step in default output

Browse Source 
coder-mos1 scanned pipeline #2186 with -f json and found 9/9 child steps; my scan of the
same pipeline in the wrapper's default text mode showed 8. Verified: text mode omits
clone (JSON shows the ci workflow entry, clone, and the 8 visible ones).

Every full step scan performed tonight enumerated 8 of 9 real child steps and reported
it as complete. clone succeeded throughout so no verdict changes — but the method was
incomplete and its user did not know.

The merge-gate mandate requires a FULL step scan and requires verdicts to enumerate the
step count. A verdict citing 8 where 9 exist is non-conforming evidence, and a gate using
this wrapper's default output would produce exactly that while believing it complied.

The shape is the session's thesis aimed at the detection tool: the doc says read the
artifact not the summary, and text mode IS a summary that looks like an artifact. Compare
D-24 — mergeable was a true answer to a different question; this is a true answer to a
smaller one.

Caught only because two observers' counts disagreed; neither alone would have found it.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
2026-08-01 00:49:01 -05:00
co-authored by Claude Opus 5
parent eddf718a5c
commit 73a313301b
1 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/remediation/TASKS.md
+35
View File
@@ -221,6 +221,41 @@ reviewer, and no other seat holds mosaicstack write. Flagged to the coordinator
busy lane. Not blocking today — RM-02's code blockers are independently disqualifying — but the next
otherwise-clean PR meets this.
### D-33 — the tool used for "full step scans" silently prunes a step in its default output
`coder-mos1` reported a **9/9** child-step scan of pipeline #2186 using `-f json`. My scan of the same
pipeline, using the same wrapper in its **default text mode**, showed **8**. Verified:
| mode | steps enumerated |
| -------------------------------------------- | ----------------------------------------------------------- |
| `pipeline-status.sh -n 2186` (text, default) | **8** — begins at `ci-postgres` |
| `pipeline-status.sh -n 2186 -f json` | **10** — the `ci` workflow entry, **`clone`**, plus those 8 |
**The default output omits `clone`.** Every "full step scan" performed tonight — RM-01, RM-02 across four
pipelines, RM-03 — enumerated **8 of 9 real child steps**, and reported that as complete. `clone`
succeeded in every case, so **no verdict changes**; the _method_ was incomplete and its user did not know.
**Why this is more than a cosmetic gap.** The merge-gate mandate requires CI verified _"by a **full step
scan** — a `tests-complete` step is a pruning-tell, never a completion-tell"_, and requires every verdict
to enumerate _"pipeline id + the step-scan result (step count, any SKIPs…)"_. **A verdict citing 8 steps
where 9 exist is non-conforming evidence** — and if the gate uses this wrapper's default output, it will
produce exactly that while believing it complied.
**The shape is the session's own thesis, aimed at the tool built to detect it.** The doc's instruction is
literally _"read the artifact, not the summary."_ The text mode **is** a summary. It looks like an
artifact — a labelled list of named steps with states — which is precisely why nobody checked it against
the raw record. **A summary that resembles an enumeration is more dangerous than one that obviously
summarises.** Compare D-24: `mergeable` was a _true answer to a different question_; here the step list is
a _true answer to a smaller question_.
Caught only because a seat used `-f json` and its count disagreed with mine. **A disagreement between two
observers surfaced it; neither observer alone would have.**
**Requirements.** RM-02 registers a case asserting the scan enumerates the **full** child-step set
(compare text-mode count against the JSON record, must-fail on divergence). The merge-gate must scan from
the **JSON/API record**, never the text summary, and state the step count it saw. The wrapper's default
output should either include `clone` or **stop presenting itself as a complete step list**.
### D-32 — the repaired gate shipped with a documented switch to skip it
`rev-974` blocked RM-03 (PR #1032) on a single finding, and it is the one that mattered: