Authored by installer-7; committed by mos-claude (no credential for this remote).
push-guard.sh and test-push-guard.sh are BYTE-IDENTICAL to the previously cleared
versions — every change this round is in the harness, confirming the reviewer's
framing that none of the three blockers was in the guard itself.
B1 verify-clean-clone.sh could not verify the artifact in its real monorepo location:
it resolved ROOT but kept artifacts as bare basenames, so running it in place
reported all artifacts NOT TRACKED. Its own suite missed this because every
fixture installed artifacts at fixture ROOT — a fixture encoding a layout the
real subject does not have. PREFIX now comes from 'git rev-parse --show-prefix'
and is threaded through the ls-tree pathspec, the cloned stat, and the suite cwd;
the verifier PRINTS the prefix. Three needles: nested-layout pass, prefix-reported
(else a green only means the prefix was ignored harmlessly), and mode-needle-still-
bites-nested (a prefix threaded into the clone but not ls-tree would silently stop
checking modes).
B2 the generator reported full coverage and exited 0 on a RED baseline — any
pre-existing failure marked every mutant killed. Now refuses unless baseline is
exit 0 with zero failures, prints the actual tally on refusal, emits no table, and
scores kills by NAMED DELTA rather than a raw red count.
B3 the generator mutated the reviewed source in place; SIGKILL stranded a mutant and
contaminated a following run. Guard and suite are now copied into a temp dir and
mutations apply to that copy — no restore step to fail. The author's first control
for this was itself vacuous (a 3s kill lands during baseline, before any mutation,
so it passed against the unfixed mechanism too); the real control drives the kill
from inside the run on the second suite invocation, plus a needle proving the
reconstructed pre-fix mechanism DOES strand.
Corrections: 'shellcheck clean' had been measured at -S warning and published
unqualified — a filtered measurement stated as an unfiltered claim. Now clean at
DEFAULT severity across six files with one scoped, documented SC2016 disable.
ARTIFACTS extended five -> six so the test files no longer omit themselves.
Verified before commit: six files sha256-matched to the author's hashes; shellcheck
exit 0 at default severity; push-guard 46/46 and verifier 9/9 run directly; the
in-place verifier resolved the real nested prefix against this tree.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H
