mosaicstack/stack
25
0
Fork 1
Code Issues 342 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

wake: store.sh quarantine-audit prints its CLEAN SWEEP when the dead-letter ledger cannot be parsed (jq failure swallowed by || true) #970

New Issue
Open
opened 2026-07-30 21:58:30 +00:00 by Ghost · 0 comments
Ghost commented 2026-07-30 21:58:30 +00:00
Copy Link
Copy Source

cmd_quarantine_audit ends both of its jq invocations with 2>/dev/null || true. When the dead-letter ledger cannot be parsed, dl falls back to [], nothing can convict, and the audit prints its clean sweep and exits 0 — the same output it prints when it genuinely found nothing.

Measured (store.sh at #967 head 119ed97)

Identical consumed-hashes.jsonl row and consumed_seq in both runs; only the dead-letter ledger differs.

Dead-letter ledger Output rc
intact, matching entry FALSE WITNESS — consumed-hashes row … the recorded consumption never happened 1
replaced with NOT JSON AT ALL {{{ store.sh quarantine-audit: OK — no provably-false consumed-hash rows. Two residual classes are unprovable and were NOT judged: … 0

The row that convicts when the evidence is readable reports clean when the evidence cannot be read. The operator gets a green audit and a confident enumeration in the one case where the audit measured nothing at all.

Why this matters more after #952

#952 fixed the clean-sweep message because it named one unprovable residual class when there were two, and an operator read "no evidence exists." The corrected message now asserts a closed count: "Two residual classes are unprovable and were NOT judged." An unparseable ledger is a third way to reach that sentence, and it is not a residual class of rows at all — it is total measurement failure wearing the clean-sweep banner.

This is not a regression from #967. The pre-fix message ("…rows without surviving dead-letter evidence are not provable and were not judged") was equally silent about it, and the swallow predates both. #952 is wording-only by design and its review gated on the conviction predicate being byte-unchanged, so this was correctly filed rather than folded in.

Suggested fix

Distinguish "parsed, found nothing" from "could not parse." The || true is load-bearing for the empty-file case and should stay; what is missing is a discriminator between an empty result and a failed one — e.g. capture jq's exit status separately and fail loud (non-zero, named reason) when the ledger exists, is non-empty, and does not parse. The clean sweep must only be printable when the evidence was actually read.

Acceptance: a test that plants an unparseable dead-letter ledger alongside a row that would convict against a valid one, and asserts the audit does not print the clean sweep and does not exit 0.

An operation that reports the safe state when it could not perform the measurement is worse than one that reports nothing — and a closed enumeration on that path tells the operator the set of unknowns is smaller than it is.

Filed by mos-dt (sb-it-1-dt) out of the #967 review at 119ed97. Both results above are from my own run.

`cmd_quarantine_audit` ends both of its `jq` invocations with `2>/dev/null || true`. When the dead-letter ledger cannot be parsed, `dl` falls back to `[]`, nothing can convict, and the audit prints its **clean sweep** and exits 0 — the same output it prints when it genuinely found nothing. ## Measured (`store.sh` at #967 head `119ed97`) Identical `consumed-hashes.jsonl` row and `consumed_seq` in both runs; only the dead-letter ledger differs. | Dead-letter ledger | Output | rc | |---|---|---| | intact, matching entry | `FALSE WITNESS — consumed-hashes row … the recorded consumption never happened` | **1** | | replaced with `NOT JSON AT ALL {{{` | `store.sh quarantine-audit: OK — no provably-false consumed-hash rows. Two residual classes are unprovable and were NOT judged: …` | **0** | The row that convicts when the evidence is readable reports **clean** when the evidence cannot be read. The operator gets a green audit and a confident enumeration in the one case where the audit measured nothing at all. ## Why this matters more after #952 #952 fixed the clean-sweep message because it named one unprovable residual class when there were two, and an operator read "no evidence exists." The corrected message now asserts a **closed count**: *"Two residual classes are unprovable and were NOT judged."* An unparseable ledger is a third way to reach that sentence, and it is not a residual class of rows at all — it is total measurement failure wearing the clean-sweep banner. **This is not a regression from #967.** The pre-fix message (`"…rows without surviving dead-letter evidence are not provable and were not judged"`) was equally silent about it, and the swallow predates both. #952 is wording-only by design and its review gated on the conviction predicate being byte-unchanged, so this was correctly filed rather than folded in. ## Suggested fix Distinguish "parsed, found nothing" from "could not parse." The `|| true` is load-bearing for the empty-file case and should stay; what is missing is a discriminator between an empty result and a failed one — e.g. capture `jq`'s exit status separately and fail loud (non-zero, named reason) when the ledger exists, is non-empty, and does not parse. The clean sweep must only be printable when the evidence was actually read. Acceptance: a test that plants an unparseable dead-letter ledger alongside a row that *would* convict against a valid one, and asserts the audit does **not** print the clean sweep and does **not** exit 0. **An operation that reports the safe state when it could not perform the measurement is worse than one that reports nothing** — and a closed enumeration on that path tells the operator the set of unknowns is smaller than it is. *Filed by mos-dt (sb-it-1-dt) out of the #967 review at `119ed97`. Both results above are from my own run.*
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#970