fix(quality): anchor quantified registry populations
ci/woodpecker/pr/ci Pipeline was successful

This commit is contained in:
2026-08-01 12:39:49 -05:00
parent 32b490a712
commit fbb6191298
14 changed files with 594 additions and 37 deletions
+132 -20
View File
@@ -40,6 +40,10 @@
"checkout-preflight/misspelled-outcome-field",
"checkout-preflight/wrong-outcome-field-type",
"checkout-preflight/empty-outcome-pattern",
"checkout-preflight/delayed-registry-introduction",
"checkout-preflight/empty-registry-populations",
"checkout-preflight/all-gates-evidence-subject-bound",
"checkout-preflight/all-gates-type-strict",
"ci-queue-wait/no-status-required",
"ci-queue-wait/unknown-option",
"hook-pre-commit/lint-staged-failure",
@@ -234,37 +238,78 @@
},
{
"id": "RM02-HISTORY-BOUNDARY",
"originalText": "The history activation boundary is derived as the parent of the first first-parent commit that introduces the registry.",
"currentText": "The history activation boundary is derived as the parent of the first first-parent commit that introduces the registry.",
"originalText": "The audited branch range begins at the provider target merge-base, sound against a branch author who cannot rewrite main but not against main compromise; Builds 1-2 own the residual.",
"currentText": "The audited branch range begins at the provider target merge-base, sound against a branch author who cannot rewrite main but not against main compromise; Builds 1-2 own the residual.",
"claimType": "integrity",
"source": "docs/remediation/TASKS.md#d-17",
"meaningChanges": [],
"caseRefs": [
"checkout-preflight/history-seam-head",
"checkout-preflight/history-seam-parent",
"checkout-preflight/history-seam-introduction"
"checkout-preflight/history-seam-introduction",
"checkout-preflight/delayed-registry-introduction"
]
},
{
"id": "RM02-EVIDENCE-SUBJECT-BINDING",
"originalText": "A provider evidence identity cannot establish success for more than one commit subject.",
"currentText": "A provider evidence identity cannot establish success for more than one commit subject.",
"originalText": "For every registered gate, evidence is bound to that gate subject under review; no evidence identity can certify a different or second subject.",
"currentText": "For every registered gate, evidence is bound to that gate subject under review; no evidence identity can certify a different or second subject.",
"claimType": "integrity",
"source": "docs/remediation/TASKS.md#d-38",
"meaningChanges": [],
"caseRefs": ["checkout-preflight/provider-cross-commit-duplicate"]
"caseRefs": [
"checkout-preflight/provider-cross-commit-duplicate",
"checkout-preflight/all-gates-evidence-subject-bound"
],
"gateRefs": [
"quality-typecheck",
"quality-lint",
"quality-format",
"checkout-preflight",
"ci-queue-wait",
"hook-pre-commit",
"hook-pre-push"
]
},
{
"id": "RM02-TYPE-STRICT-SCHEMA",
"originalText": "Every registry discriminator and comparison field is recursively closed and type-strict so a misspelling cannot disable an assertion.",
"currentText": "Every registry discriminator and comparison field is recursively closed and type-strict so a misspelling cannot disable an assertion.",
"originalText": "For every registered gate, each discriminator and comparison input is recursively closed and type-strict so malformed values cannot disable its assertion.",
"currentText": "For every registered gate, each discriminator and comparison input is recursively closed and type-strict so malformed values cannot disable its assertion.",
"claimType": "integrity",
"source": "docs/remediation/TASKS.md#d-40",
"meaningChanges": [],
"caseRefs": [
"checkout-preflight/misspelled-outcome-field",
"checkout-preflight/wrong-outcome-field-type",
"checkout-preflight/empty-outcome-pattern"
"checkout-preflight/empty-outcome-pattern",
"checkout-preflight/all-gates-type-strict"
],
"gateRefs": [
"quality-typecheck",
"quality-lint",
"quality-format",
"checkout-preflight",
"ci-queue-wait",
"hook-pre-commit",
"hook-pre-push"
]
},
{
"id": "RM02-NONEMPTY-ANCHORED-QUANTIFICATION",
"originalText": "No universally quantified registry check runs until its population is proven non-empty and anchored.",
"currentText": "No universally quantified registry check runs until its population is proven non-empty and anchored.",
"claimType": "integrity",
"source": "docs/remediation/TASKS.md#d-46",
"meaningChanges": [],
"caseRefs": ["checkout-preflight/empty-registry-populations"],
"gateRefs": [
"quality-typecheck",
"quality-lint",
"quality-format",
"checkout-preflight",
"ci-queue-wait",
"hook-pre-commit",
"hook-pre-push"
]
}
],
@@ -348,7 +393,7 @@
"mergeAssertions": {
"mode": "unprivileged-current-tree-pr-verification",
"deferredReplayOwner": "RM-60",
"trustDependencies": ["RM-25", "RM-59", "RM-60"],
"trustDependencies": ["RM-25", "RM-59", "RM-60", "Builds 1-2 main-integrity bootstrap"],
"providerEvidence": "assert retained current-tree terminal-success records for prior commits; report absent, expired, or current-running evidence without inference",
"postMergeResponse": "protected isolated replay is detection, not prevention; quarantine and revert on failure"
},
@@ -409,7 +454,8 @@
]
}
}
]
],
"evidenceSubject": "quality-typecheck"
},
{
"id": "quality-lint",
@@ -467,7 +513,8 @@
]
}
}
]
],
"evidenceSubject": "quality-lint"
},
{
"id": "quality-format",
@@ -522,7 +569,8 @@
]
}
}
]
],
"evidenceSubject": "quality-format"
},
{
"id": "checkout-preflight",
@@ -733,7 +781,7 @@
"exitCode": 1,
"outputPattern": "history boundary candidate head rejected"
},
"reasonPattern": "derived activation is parent of registry introduction"
"reasonPattern": "derived activation is provider target merge-base"
},
{
"id": "history-seam-parent",
@@ -748,7 +796,7 @@
"exitCode": 1,
"outputPattern": "history boundary candidate parent rejected"
},
"reasonPattern": "derived activation is parent of registry introduction"
"reasonPattern": "derived activation is provider target merge-base"
},
{
"id": "history-seam-introduction",
@@ -763,7 +811,7 @@
"exitCode": 1,
"outputPattern": "history boundary candidate introduction rejected"
},
"reasonPattern": "derived activation is parent of registry introduction"
"reasonPattern": "derived activation is provider target merge-base"
},
{
"id": "provider-cross-commit-duplicate",
@@ -890,8 +938,69 @@
}
]
}
},
{
"id": "delayed-registry-introduction",
"criterionIds": ["RM02-CHECK-RIGHT", "RM02-HISTORY-BOUNDARY"],
"mustFail": true,
"invocation": ["node", "scripts/gate-delayed-introduction-control.mjs"],
"required": {
"exitCode": 1,
"outputPattern": "delayed registry introduction rejected"
},
"actual": {
"exitCode": 1,
"outputPattern": "delayed registry introduction rejected"
},
"reasonPattern": "own-tree registry cannot be read"
},
{
"id": "empty-registry-populations",
"criterionIds": ["RM02-CHECK-RIGHT", "RM02-NONEMPTY-ANCHORED-QUANTIFICATION"],
"mustFail": true,
"invocation": ["node", "scripts/gate-empty-population-control.mjs"],
"required": {
"exitCode": 1,
"outputPattern": "empty universally quantified registry populations rejected"
},
"actual": {
"exitCode": 1,
"outputPattern": "empty universally quantified registry populations rejected"
},
"reasonPattern": "empty universally quantified registry populations rejected"
},
{
"id": "all-gates-evidence-subject-bound",
"criterionIds": ["RM02-CHECK-RIGHT", "RM02-EVIDENCE-SUBJECT-BINDING"],
"mustFail": true,
"invocation": ["node", "scripts/gate-population-control.mjs", "evidence-subject"],
"required": {
"exitCode": 1,
"outputPattern": "evidence-subject population control rejected every registered gate"
},
"actual": {
"exitCode": 1,
"outputPattern": "evidence-subject population control rejected every registered gate"
},
"reasonPattern": "evidence-subject population control rejected every registered gate"
},
{
"id": "all-gates-type-strict",
"criterionIds": ["RM02-CHECK-RIGHT", "RM02-TYPE-STRICT-SCHEMA"],
"mustFail": true,
"invocation": ["node", "scripts/gate-population-control.mjs", "type-strict"],
"required": {
"exitCode": 1,
"outputPattern": "type-strict population control rejected every registered gate"
},
"actual": {
"exitCode": 1,
"outputPattern": "type-strict population control rejected every registered gate"
},
"reasonPattern": "type-strict population control rejected every registered gate"
}
]
],
"evidenceSubject": "checkout-preflight"
},
{
"id": "ci-queue-wait",
@@ -1267,7 +1376,8 @@
"writeFiles": []
}
}
]
],
"evidenceSubject": "ci-queue-wait"
},
{
"id": "hook-pre-commit",
@@ -1343,7 +1453,8 @@
]
}
}
]
],
"evidenceSubject": "hook-pre-commit"
},
{
"id": "hook-pre-push",
@@ -1419,7 +1530,8 @@
]
}
}
]
],
"evidenceSubject": "hook-pre-push"
}
]
}