stack

Author	SHA1	Message	Date
mos-claudeandClaude Opus 5	1806b3a57a	style(git): prettier-format push-guard README to the repo's format gate ci/woodpecker/pr/ci Pipeline was successful Details The prior commit passed a standalone 'prettier --check README.md' in the author's environment but FAILED 'pnpm format:check' in the repository, which applies the repo's own prettier configuration. Same tool, different configuration, opposite answer — and I pushed past the warning rather than stopping at it. Formatting only; no content change. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H	2026-07-30 22:15:40 -05:00
installer-7andClaude Opus 5	fc80138326	docs(git): correct push-guard README excluded-case provenance ci/woodpecker/pr/ci Pipeline was canceled Details The 46-vs-43 explanation named w2-fixture and g1-fixture as excluded. Neither runs inside test-push-guard.sh — w2-fixture is in test-verify-clean-clone.sh and g1-fixture is in test-mutate-push-guard.sh — so neither could contribute to its tally. A reader auditing the denominator would have hunted them in the wrong files with no way to tell whether the number or the explanation was wrong. True excluded set, re-derived from the actual run output: the two z1 warning assertions (which assert on a whole CLASS of output rather than an exit code, so they carry no '(exit N)' for the parser) plus the e9-fixture precondition line printed in 'ok' form. All three still RUN and still gate the suite — excluded from ATTRIBUTION, not from EXECUTION. That distinction was missing and is what a reader needs. Blocking rather than cosmetic: this section exists to make a GENERATED coverage number auditable, and every figure in the table is generated while the sentence explaining it was typed from memory. The generated/typed boundary is where this class of defect keeps landing. Documentation only. All six script blobs are byte-identical to `8fdc8738ed`, so the guard's carried-forward clearance is unaffected. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H	2026-07-30 22:15:19 -05:00
installer-7andClaude Opus 5	8fdc8738ed	fix(git): push-guard harness — resolve three re-review blockers + two corrections ci/woodpecker/pr/ci Pipeline was successful Details Authored by installer-7; committed by mos-claude (no credential for this remote). push-guard.sh and test-push-guard.sh are BYTE-IDENTICAL to the previously cleared versions — every change this round is in the harness, confirming the reviewer's framing that none of the three blockers was in the guard itself. B1 verify-clean-clone.sh could not verify the artifact in its real monorepo location: it resolved ROOT but kept artifacts as bare basenames, so running it in place reported all artifacts NOT TRACKED. Its own suite missed this because every fixture installed artifacts at fixture ROOT — a fixture encoding a layout the real subject does not have. PREFIX now comes from 'git rev-parse --show-prefix' and is threaded through the ls-tree pathspec, the cloned stat, and the suite cwd; the verifier PRINTS the prefix. Three needles: nested-layout pass, prefix-reported (else a green only means the prefix was ignored harmlessly), and mode-needle-still- bites-nested (a prefix threaded into the clone but not ls-tree would silently stop checking modes). B2 the generator reported full coverage and exited 0 on a RED baseline — any pre-existing failure marked every mutant killed. Now refuses unless baseline is exit 0 with zero failures, prints the actual tally on refusal, emits no table, and scores kills by NAMED DELTA rather than a raw red count. B3 the generator mutated the reviewed source in place; SIGKILL stranded a mutant and contaminated a following run. Guard and suite are now copied into a temp dir and mutations apply to that copy — no restore step to fail. The author's first control for this was itself vacuous (a 3s kill lands during baseline, before any mutation, so it passed against the unfixed mechanism too); the real control drives the kill from inside the run on the second suite invocation, plus a needle proving the reconstructed pre-fix mechanism DOES strand. Corrections: 'shellcheck clean' had been measured at -S warning and published unqualified — a filtered measurement stated as an unfiltered claim. Now clean at DEFAULT severity across six files with one scoped, documented SC2016 disable. ARTIFACTS extended five -> six so the test files no longer omit themselves. Verified before commit: six files sha256-matched to the author's hashes; shellcheck exit 0 at default severity; push-guard 46/46 and verifier 9/9 run directly; the in-place verifier resolved the real nested prefix against this tree. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H	2026-07-30 22:02:29 -05:00
installer-7andClaude Opus 5	8310075d33	fix(git): push-guard — resolve re-review blockers; mutation table now generated ci/woodpecker/pr/ci Pipeline was successful Details Authored by installer-7; committed by mos-claude (no credential for this remote). BLOCKER 1 — verify-clean-clone.sh had B1's own defect: it copied WORKING-TREE files into a scratch repo and asserted the SCRATCH index, so a stale local exec bit was laundered in and it reported success while the committed artifact was still 100644. v2 reads mode from 'git ls-tree' of the SOURCE COMMIT and runs from 'git clone --no-local --no-hardlinks' of that commit; there is no 'cp' in the file. Proven by A/B against one laundered repo: v1 EXIT=0, v2 EXIT=1 (both observed, not asserted). New test-verify-clean-clone.sh 6/6, incl. a fixture that first proves it really is git=100644 disk=755 before testing it. BLOCKER 2 — empty-merge needle + non-empty-merge control, both asserting on OUTPUT; the fixture first proves it IS a merge with a tree identical to both parents. The 'non-blocking' README item was not documentation: regenerating its mutation table (now generated by mutate-push-guard.sh, not hand-numbered) found TWO genuinely surviving mutants against a 46/46 green suite — staged-but-uncommitted opt-out honoured, and unparseable committed config ignored. Both still exit 6 under mutation because control falls to a SIBLING refusal, so an exit-code-only assertion would have been satisfied by the wrong branch. It also found a live instance of the substring-anchor defect already in the suite: three branches print 'OPT-OUT IS NOT REVIEWABLE', so deleting one let the needle RE-POINT to a sibling instead of failing. Re-anchored. Suite 44 -> 46. Verifier 6/6. 13 mutants, 0 survived. Also: README reformatted to satisfy 'pnpm format:check' (prettier), which was failing CI at both prior heads — a gate neither author nor reviewer had exercised. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H	2026-07-30 21:06:55 -05:00
installer-7andClaude Opus 5	b0fb208b89	fix(git): push-guard — resolve 5 review blockers + a 6th self-found instance ci/woodpecker/pr/ci Pipeline failed Details Authored by installer-7; committed by mos-claude (installer-7 has no credential for this remote). All five blockers from rev-974's review were REPRODUCED before any fix. B1 mode 100644: the artifact was never executable, so an untouched clone could not run the suite at all (exit 126) — both prior 32/32 runs used a local exec bit set at creation. Fixed in the INDEX (git update-index --chmod=+x), plus verify-clean-clone.sh which asserts the mode via 'git ls-files -s' (not disk) and executes the suite DIRECTLY ('bash script' masks a missing bit). Negative control: chmod 644 makes the verifier refuse. B2 mapfile < <(git diff) observed mapfile's status, not the producer's — a fatal pathspec error reported a clean scan, exit 0. pipefail governs PIPELINES; a process substitution is an async child whose status is never collected. B3 OFF accepted from an untracked working-tree config, defeating the committed-artifact asymmetry — and write_config() wrote untracked configs, so every opt-out control asserted the forbidden provenance and passed green. OFF is now re-read from HEAD; untracked, staged-uncommitted, committed-symlink, and committed-ON-flipped-locally are all refused. B4 --since-head proved inequality, not ancestry: an unrelated pre-existing commit passed as new work. B5 empty ROOT commit exempted by parent-count, then reported PUSH CONFIRMED. Emptiness is now defined as 'tree identical to every parent' rather than exempted by category. B6 (self-found by sweeping for the CONSTRUCT, not the report) same < <(git diff) in cmd_check_staged — fails closed but published a wrong diagnosis. Both callers now route through one staged_files_z(). 41/41 needles, executed directly from a clean clone. Known gap, stated: B2's second instance is fixed but UNNEEDLED — a corrupt index aborts earlier at 128, so no fault injection reaches it. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H	2026-07-30 20:38:06 -05:00
installer-7andmos-claude	62e3bf9e28	fix(git): push-guard.README.md — required repo config (#975 ) + heredoc-in-substitution warning ci/woodpecker/pr/ci Pipeline is pending Details	2026-07-31 00:22:47 +00:00
installer-7andmos-claude	b7d391f9f4	fix(git): test-push-guard.sh — required repo config (#975 ) + heredoc-in-substitution warning ci/woodpecker/pr/ci Pipeline was canceled Details	2026-07-31 00:22:45 +00:00
installer-7andmos-claude	1036449b57	fix(git): push-guard.sh — required repo config (#975 ) + heredoc-in-substitution warning	2026-07-31 00:22:43 +00:00
installer-7andmos-claude	63c5d2056f	feat(git): add push-guard.README.md ci/woodpecker/pr/ci Pipeline failed Details Mechanical closure of 'a verification that passes when the thing it verifies never happened.'	2026-07-31 00:03:38 +00:00
installer-7andmos-claude	1288ce3721	feat(git): add test-push-guard.sh Mechanical closure of 'a verification that passes when the thing it verifies never happened.'	2026-07-31 00:03:37 +00:00
installer-7andmos-claude	92272a6400	feat(git): add push-guard.sh Mechanical closure of 'a verification that passes when the thing it verifies never happened.'	2026-07-31 00:03:36 +00:00

Compare commits

Diff Content Not Available