From b5792537b07b4793cf6b73a5fdaed112e3c32265 Mon Sep 17 00:00:00 2001 From: code-be-01 Date: Mon, 24 Aug 2026 16:08:43 -0500 Subject: [PATCH 1/2] test(git-tools): wrapper-guard harness distinguishes tool failure from drift (#1380-FF) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pipeline 2635 (merge-verify of 8eb7e635) failed one advice assertion ('a PR is an issue where labels live...') while pipeline 2634 (same content, PR event) and 2636 (same tree + one commit) both passed, and the fixture is stable under 200 direct iterations, 10 suite runs, four locales, and 60 suite runs inside alpine/busybox 1.37 (the CI userspace). Mechanism: the harness's 'if ! ... | grep -Fq' shape treats ANY nonzero from the pipeline as an advice mismatch — including a transient grep failure (fork/alloc error on a loaded k8s node), which prints the identical FAIL line without any guard defect. The guard's rc-2 sites were audited: every classification branch that can fire on this payload names issue-edit.sh, so no code path produces the observed output. Fix: the advice assertion now retries grep on rc>=2 (tool error) up to 3x, treats rc=1 as the real mismatch, and on persistent tool failure prints a distinct TOOL-ERROR line (still fail=1 — never green on infra noise, but the line names the class so a re-run can be judged instead of debugged as guard drift). Advice-mismatch direction proven unchanged by mutation (bogus wrapper name still FAILs both labels arms). Suite 292/292 x2 locally and under busybox. --- .../framework/tools/git/test-wrapper-guard.sh | 33 ++++++++++++++++--- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/packages/mosaic/framework/tools/git/test-wrapper-guard.sh b/packages/mosaic/framework/tools/git/test-wrapper-guard.sh index a72fe1e1..bffa0d99 100755 --- a/packages/mosaic/framework/tools/git/test-wrapper-guard.sh +++ b/packages/mosaic/framework/tools/git/test-wrapper-guard.sh @@ -521,6 +521,26 @@ while IFS=$'\t' read -r want payload why remedy; do n=$((n + 1)) out="$(printf '%s' "$payload" | "$GUARD" 2>&1)" got=$? + # Flake containment (stack#1380-FF, pipeline 2635): a transient failure of + # the ASSERTION TOOLING (grep/fork/alloc error under node pressure) is not a + # contract drift, but this loop's `if !` shape made it indistinguishable + # from one — the harness printed the advice-mismatch FAIL and failed a merge + # verify on a run whose guard output was correct. Distinguish the two: an + # assertion tool that itself fails is retried a bounded number of times, and + # if it never succeeds the case reports a TOOL-ERROR line (fail=1 stays, so + # the run is never green-on-infra-noise, but the line names the real class + # and a re-run can be judged instead of debugged as a guard defect). + assert_out_names() { + local attempt rc1 + for attempt in 1 2 3; do + printf '%s' "$out" | grep -Fq -- "$1" && return 0 + rc1=$? + [ "$rc1" -eq 1 ] && return 1 # grep answered NO — real mismatch + sleep 0.2 # rc>=2: grep itself errored — retry + done + printf 'TOOL-ERROR %s (assertion grep failed 3x; guard output was correct class — infra/tooling, not guard drift)\n' "$why" >&2 + return 2 + } if [ "$got" != "$want" ]; then printf 'FAIL %s (want exit %s, got %s)\n' "$why" "$want" "$got" fail=1 @@ -530,10 +550,15 @@ while IFS=$'\t' read -r want payload why remedy; do # now it was invisible here: the harness read the exit code and nothing else, # so /issues/1/labels blocking with "use issue-create.sh" passed every run for # six rounds. Where a fixture states the remediation it expects, assert it. - if [ -n "${remedy:-}" ] && ! printf '%s' "$out" | grep -Fq -- "$remedy"; then - printf 'FAIL %s (blocked, but the advice does not name %s)\n' "$why" "$remedy" - fail=1 - continue + if [ -n "${remedy:-}" ]; then + assert_out_names "$remedy" + arcret=$? + if [ "$arcret" -eq 1 ]; then + printf 'FAIL %s (blocked, but the advice does not name %s)\n' "$why" "$remedy" + fail=1 + continue + fi + [ "$arcret" -eq 0 ] || { fail=1; continue; } fi printf 'ok %s\n' "$why" done < "$FIXTURES" -- 2.54.0 From 80752188b14ac99ebd0eac0a640c1bcc55c390d8 Mon Sep 17 00:00:00 2001 From: code-be-01 Date: Mon, 24 Aug 2026 16:17:54 -0500 Subject: [PATCH 2/2] test(git-tools): classify tool failure at every needle site (#1380-FF) Pipeline 2637 red on a SECOND needle arm (home_case symlink message) proved the flake shape is not one site: every 'if ! ... | grep -Fq' assertion in the harness printed the identical FAIL line for a transient grep failure (rc>=2, fork/alloc under node pressure) and a real mismatch. The retry/classify helper is hoisted to one shared function and applied at all three needle sites (fixture loop, home_case, standalone case): retry tool errors 3x, rc=1 is the real mismatch, persistent tool failure reports TOOL-ERROR (fail stays 1). 292/292 x2 + busybox. --- .../framework/tools/git/test-wrapper-guard.sh | 58 ++++++++++++------- 1 file changed, 38 insertions(+), 20 deletions(-) diff --git a/packages/mosaic/framework/tools/git/test-wrapper-guard.sh b/packages/mosaic/framework/tools/git/test-wrapper-guard.sh index bffa0d99..bd4035f4 100755 --- a/packages/mosaic/framework/tools/git/test-wrapper-guard.sh +++ b/packages/mosaic/framework/tools/git/test-wrapper-guard.sh @@ -515,6 +515,25 @@ FIXTURES="$TMP/fixtures.tsv" printf '0\t{"tool_input":{"command":"curl -s https://git.example.invalid/api/v1/repos/a/b/issues?q=a%%20b"}}\ta percent-escape in a READ is not this hook'"'"'s business\n' } > "$FIXTURES" +# Flake containment (#1380-FF, pipelines 2635/2637): a transient failure of the +# ASSERTION TOOLING (grep rc>=2 — fork/alloc error under node pressure) is not a +# contract drift, but the `if ! ... | grep -Fq` shape printed the identical +# FAIL line for both, failing merge verifies on correct guard output. Classify +# instead: retry tool errors 3x; rc=1 is the real mismatch; persistent tool +# failure reports TOOL-ERROR (fail stays 1 — never green on infra noise — but +# the line names the class so a re-run can be judged, not debugged). +assert_out_contains() { # needle why + local attempt rc1 + for attempt in 1 2 3; do + printf '%s' "$out" | grep -Fq -- "$1" && return 0 + rc1=$? + [ "$rc1" -eq 1 ] && return 1 # grep answered NO — real mismatch + sleep 0.2 # rc>=2: grep itself errored — retry + done + printf 'TOOL-ERROR %s (assertion grep failed 3x — infra/tooling, not guard drift)\n' "$2" >&2 + return 2 +} + fail=0 n=0 while IFS=$'\t' read -r want payload why remedy; do [ -n "${want:-}" ] || continue @@ -530,17 +549,6 @@ while IFS=$'\t' read -r want payload why remedy; do # if it never succeeds the case reports a TOOL-ERROR line (fail=1 stays, so # the run is never green-on-infra-noise, but the line names the real class # and a re-run can be judged instead of debugged as a guard defect). - assert_out_names() { - local attempt rc1 - for attempt in 1 2 3; do - printf '%s' "$out" | grep -Fq -- "$1" && return 0 - rc1=$? - [ "$rc1" -eq 1 ] && return 1 # grep answered NO — real mismatch - sleep 0.2 # rc>=2: grep itself errored — retry - done - printf 'TOOL-ERROR %s (assertion grep failed 3x; guard output was correct class — infra/tooling, not guard drift)\n' "$why" >&2 - return 2 - } if [ "$got" != "$want" ]; then printf 'FAIL %s (want exit %s, got %s)\n' "$why" "$want" "$got" fail=1 @@ -551,7 +559,7 @@ while IFS=$'\t' read -r want payload why remedy; do # so /issues/1/labels blocking with "use issue-create.sh" passed every run for # six rounds. Where a fixture states the remediation it expects, assert it. if [ -n "${remedy:-}" ]; then - assert_out_names "$remedy" + assert_out_contains "$remedy" "$why" arcret=$? if [ "$arcret" -eq 1 ]; then printf 'FAIL %s (blocked, but the advice does not name %s)\n' "$why" "$remedy" @@ -597,10 +605,15 @@ home_case() { fail=1 return fi - if [ -n "$needle" ] && ! printf '%s' "$out" | grep -Fq -- "$needle"; then - printf 'FAIL %s (exit %s, but the message does not say %s)\n' "$why" "$got" "$needle" - fail=1 - return + if [ -n "$needle" ]; then + assert_out_contains "$needle" "$why" + arcret=$? + if [ "$arcret" -eq 1 ]; then + printf 'FAIL %s (exit %s, but the message does not say %s)\n' "$why" "$got" "$needle" + fail=1 + return + fi + [ "$arcret" -eq 0 ] || { fail=1; return; } fi printf 'ok %s\n' "$why" } @@ -690,10 +703,15 @@ lone_case() { fail=1 return fi - if [ -n "$needle" ] && ! printf '%s' "$out" | grep -Fq -- "$needle"; then - printf 'FAIL %s [standalone] (exit %s, but the message does not say %s)\n' "$why" "$got" "$needle" - fail=1 - return + if [ -n "$needle" ]; then + assert_out_contains "$needle" "$why" + arcret=$? + if [ "$arcret" -eq 1 ]; then + printf 'FAIL %s [standalone] (exit %s, but the message does not say %s)\n' "$why" "$got" "$needle" + fail=1 + return + fi + [ "$arcret" -eq 0 ] || { fail=1; return; } fi printf 'ok %s [standalone]\n' "$why" } -- 2.54.0