From b705a4dae9810b76e5fd40fa757a239e49db9089 Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Fri, 31 Jul 2026 17:28:35 -0500 Subject: [PATCH] =?UTF-8?q?docs(remediation):=20sharpen=20D-8=20=E2=80=94?= =?UTF-8?q?=20the=20conformance=20harness=20must=20itself=20be=20conforman?= =?UTF-8?q?ce-tested?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per Mos. Two requirements, both load-bearing: RM-02: the gate registry must SELF-VERIFY that every registered case demonstrably runs and demonstrably fails on a known-bad input. Presence in the registry is not evidence. A check is not trusted until it has been shown to fail. This is mutation testing / negative control at the registry level — the conformance harness must itself be conformance-tested. RM-55 inherits the same recursion: the harness must be observed red before its green means anything. Reviewer disclosure: rev-974 could have silently substituted a working fixture and reported AC2 PASS, and nothing would have caught it. The 'if a check is unrunnable, say so rather than silently substituting' clause is what makes a PASS mean anything, and must appear in every reviewer brief this mission issues. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/TASKS.md | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 4b9a4ca6..58e68115 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -115,9 +115,24 @@ Two things this establishes: small instance of the mission's own class — an unverified gate — occurring inside the mechanism built to catch unverified gates. -**Requirement on RM-02:** the gate registry must itself be exercised. A registered case that cannot -fail (or cannot run) is as inert as an unregistered one, and the registry check must detect that — -`--dry-run`-style self-verification of every registered case, not merely its presence. +**Requirement on RM-02 (non-negotiable, sharpened by Mos).** The registry must **self-verify** that +every registered case demonstrably **runs** and demonstrably **fails on a known-bad input**. +Presence in the registry is **not** evidence. **A check is not trusted until it has been shown to +fail.** This is mutation testing / negative control applied _at the registry level_ — meaning +**the conformance harness must itself be conformance-tested.** A registered case that cannot fail, or +cannot run, is exactly as inert as an unregistered one, and the registry check must detect that +itself rather than assume it. + +**Requirement on RM-55.** The same recursion applies to the harness: it must be observed red before +its green is worth anything (OPUS R-063 AC1 already states this; D-8 is the empirical case for it). + +**Second, equally load-bearing lesson — reviewer disclosure is what makes a review trustworthy.** +rev-974 could have silently swapped in a working fixture and reported `AC2 PASS`. Nothing in the +process would have caught it, and the resulting green would have certified nothing — on the very task +whose subject is gates that only appear to work. The brief's instruction — _"do not adjust a check to +fit the diff; if it is genuinely unrunnable as specified, say so explicitly and explain why rather +than silently substituting your own"_ — is therefore not boilerplate. It is the clause that makes a +PASS mean something, and it must appear in **every** reviewer brief this mission issues. ### D-7 — shared-tmpfs contention → cascading ENOSPC (live incident, 2026-07-31)