The prior commit passed a standalone 'prettier --check README.md' in the author's
environment but FAILED 'pnpm format:check' in the repository, which applies the
repo's own prettier configuration. Same tool, different configuration, opposite
answer — and I pushed past the warning rather than stopping at it.
Formatting only; no content change.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H
The 46-vs-43 explanation named w2-fixture and g1-fixture as excluded. Neither runs
inside test-push-guard.sh — w2-fixture is in test-verify-clean-clone.sh and
g1-fixture is in test-mutate-push-guard.sh — so neither could contribute to its
tally. A reader auditing the denominator would have hunted them in the wrong files
with no way to tell whether the number or the explanation was wrong.
True excluded set, re-derived from the actual run output: the two z1 warning
assertions (which assert on a whole CLASS of output rather than an exit code, so
they carry no '(exit N)' for the parser) plus the e9-fixture precondition line
printed in 'ok' form. All three still RUN and still gate the suite — excluded from
ATTRIBUTION, not from EXECUTION. That distinction was missing and is what a reader
needs.
Blocking rather than cosmetic: this section exists to make a GENERATED coverage
number auditable, and every figure in the table is generated while the sentence
explaining it was typed from memory. The generated/typed boundary is where this
class of defect keeps landing.
Documentation only. All six script blobs are byte-identical to 8fdc8738ed, so the
guard's carried-forward clearance is unaffected.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H
Authored by installer-7; committed by mos-claude (no credential for this remote).
push-guard.sh and test-push-guard.sh are BYTE-IDENTICAL to the previously cleared
versions — every change this round is in the harness, confirming the reviewer's
framing that none of the three blockers was in the guard itself.
B1 verify-clean-clone.sh could not verify the artifact in its real monorepo location:
it resolved ROOT but kept artifacts as bare basenames, so running it in place
reported all artifacts NOT TRACKED. Its own suite missed this because every
fixture installed artifacts at fixture ROOT — a fixture encoding a layout the
real subject does not have. PREFIX now comes from 'git rev-parse --show-prefix'
and is threaded through the ls-tree pathspec, the cloned stat, and the suite cwd;
the verifier PRINTS the prefix. Three needles: nested-layout pass, prefix-reported
(else a green only means the prefix was ignored harmlessly), and mode-needle-still-
bites-nested (a prefix threaded into the clone but not ls-tree would silently stop
checking modes).
B2 the generator reported full coverage and exited 0 on a RED baseline — any
pre-existing failure marked every mutant killed. Now refuses unless baseline is
exit 0 with zero failures, prints the actual tally on refusal, emits no table, and
scores kills by NAMED DELTA rather than a raw red count.
B3 the generator mutated the reviewed source in place; SIGKILL stranded a mutant and
contaminated a following run. Guard and suite are now copied into a temp dir and
mutations apply to that copy — no restore step to fail. The author's first control
for this was itself vacuous (a 3s kill lands during baseline, before any mutation,
so it passed against the unfixed mechanism too); the real control drives the kill
from inside the run on the second suite invocation, plus a needle proving the
reconstructed pre-fix mechanism DOES strand.
Corrections: 'shellcheck clean' had been measured at -S warning and published
unqualified — a filtered measurement stated as an unfiltered claim. Now clean at
DEFAULT severity across six files with one scoped, documented SC2016 disable.
ARTIFACTS extended five -> six so the test files no longer omit themselves.
Verified before commit: six files sha256-matched to the author's hashes; shellcheck
exit 0 at default severity; push-guard 46/46 and verifier 9/9 run directly; the
in-place verifier resolved the real nested prefix against this tree.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H
Authored by installer-7; committed by mos-claude (no credential for this remote).
BLOCKER 1 — verify-clean-clone.sh had B1's own defect: it copied WORKING-TREE files into a
scratch repo and asserted the SCRATCH index, so a stale local exec bit was laundered in and it
reported success while the committed artifact was still 100644. v2 reads mode from 'git ls-tree'
of the SOURCE COMMIT and runs from 'git clone --no-local --no-hardlinks' of that commit; there is
no 'cp' in the file. Proven by A/B against one laundered repo: v1 EXIT=0, v2 EXIT=1 (both observed,
not asserted). New test-verify-clean-clone.sh 6/6, incl. a fixture that first proves it really is
git=100644 disk=755 before testing it.
BLOCKER 2 — empty-merge needle + non-empty-merge control, both asserting on OUTPUT; the fixture
first proves it IS a merge with a tree identical to both parents.
The 'non-blocking' README item was not documentation: regenerating its mutation table (now generated
by mutate-push-guard.sh, not hand-numbered) found TWO genuinely surviving mutants against a 46/46
green suite — staged-but-uncommitted opt-out honoured, and unparseable committed config ignored.
Both still exit 6 under mutation because control falls to a SIBLING refusal, so an exit-code-only
assertion would have been satisfied by the wrong branch. It also found a live instance of the
substring-anchor defect already in the suite: three branches print 'OPT-OUT IS NOT REVIEWABLE', so
deleting one let the needle RE-POINT to a sibling instead of failing. Re-anchored.
Suite 44 -> 46. Verifier 6/6. 13 mutants, 0 survived.
Also: README reformatted to satisfy 'pnpm format:check' (prettier), which was failing CI at both
prior heads — a gate neither author nor reviewer had exercised.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H
