Authored by installer-7; committed by mos-claude (no credential for this remote).
BLOCKER 1 — verify-clean-clone.sh had B1's own defect: it copied WORKING-TREE files into a
scratch repo and asserted the SCRATCH index, so a stale local exec bit was laundered in and it
reported success while the committed artifact was still 100644. v2 reads mode from 'git ls-tree'
of the SOURCE COMMIT and runs from 'git clone --no-local --no-hardlinks' of that commit; there is
no 'cp' in the file. Proven by A/B against one laundered repo: v1 EXIT=0, v2 EXIT=1 (both observed,
not asserted). New test-verify-clean-clone.sh 6/6, incl. a fixture that first proves it really is
git=100644 disk=755 before testing it.
BLOCKER 2 — empty-merge needle + non-empty-merge control, both asserting on OUTPUT; the fixture
first proves it IS a merge with a tree identical to both parents.
The 'non-blocking' README item was not documentation: regenerating its mutation table (now generated
by mutate-push-guard.sh, not hand-numbered) found TWO genuinely surviving mutants against a 46/46
green suite — staged-but-uncommitted opt-out honoured, and unparseable committed config ignored.
Both still exit 6 under mutation because control falls to a SIBLING refusal, so an exit-code-only
assertion would have been satisfied by the wrong branch. It also found a live instance of the
substring-anchor defect already in the suite: three branches print 'OPT-OUT IS NOT REVIEWABLE', so
deleting one let the needle RE-POINT to a sibling instead of failing. Re-anchored.
Suite 44 -> 46. Verifier 6/6. 13 mutants, 0 survived.
Also: README reformatted to satisfy 'pnpm format:check' (prettier), which was failing CI at both
prior heads — a gate neither author nor reviewer had exercised.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H
Authored by installer-7; committed by mos-claude (installer-7 has no credential for this remote).
All five blockers from rev-974's review were REPRODUCED before any fix.
B1 mode 100644: the artifact was never executable, so an untouched clone could not run the
suite at all (exit 126) — both prior 32/32 runs used a local exec bit set at creation.
Fixed in the INDEX (git update-index --chmod=+x), plus verify-clean-clone.sh which asserts
the mode via 'git ls-files -s' (not disk) and executes the suite DIRECTLY ('bash script'
masks a missing bit). Negative control: chmod 644 makes the verifier refuse.
B2 mapfile < <(git diff) observed mapfile's status, not the producer's — a fatal pathspec
error reported a clean scan, exit 0. pipefail governs PIPELINES; a process substitution is
an async child whose status is never collected.
B3 OFF accepted from an untracked working-tree config, defeating the committed-artifact
asymmetry — and write_config() wrote untracked configs, so every opt-out control asserted
the forbidden provenance and passed green. OFF is now re-read from HEAD; untracked,
staged-uncommitted, committed-symlink, and committed-ON-flipped-locally are all refused.
B4 --since-head proved inequality, not ancestry: an unrelated pre-existing commit passed as
new work.
B5 empty ROOT commit exempted by parent-count, then reported PUSH CONFIRMED. Emptiness is now
defined as 'tree identical to every parent' rather than exempted by category.
B6 (self-found by sweeping for the CONSTRUCT, not the report) same < <(git diff) in
cmd_check_staged — fails closed but published a wrong diagnosis. Both callers now route
through one staged_files_z().
41/41 needles, executed directly from a clean clone. Known gap, stated: B2's second instance is
fixed but UNNEEDLED — a corrupt index aborts earlier at 128, so no fault injection reaches it.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H
jason.woltjeandMos