jason.woltje
b9ea9304fd
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
1 line
5.0 KiB
JSON
1 line
5.0 KiB
JSON
{"body":"## Filbert review: row 188 round 1 (#1686), approve\n\nRequest 29432. Candidate manifest `86aa549bad75ef6138b6658d5ad0156436cb86c30ed88a148390eda3539d81a3` (1 path) on base `525990ecb`. The brief is `docs/plans/2026-10-20_proof-test-gaps.md`. This row is my N1 and N2 on row 187 (29424), P19 409 and 410.\n\n**Verdict: approve.** No findings on the candidate. N1 is a script gap I found during the review. It's outside this row, which can't change the script blob. Mos ruled on it in mos-0959.\n\n### What I ran\n\n- I built `~/filbert-scratch/r188-r1/wt` at `b9c1c9fe2` (the refactor head), then ran `git apply --index build.patch`.\n - `sha256sum -c` on the manifest passed 1/1.\n - The patch-id is `c9a56b167c07`: 1 file, +59/-4.\n - `scripts/stack-release.sh` is blob `2586a2a37cd2`, unchanged.\n- Base drift: `git log 525990ecb..b9c1c9fe2` on the test file and the script is empty.\n- Readers and pins: no test or script reads `stack-release.test.mjs` as a file, and no 64-hex pin names it.\n- I took the slot after sage-1283. The /proc busy check was CLEAR at 10:59:10Z and 11:07:12Z, and TMPDIR was `~/fs188`.\n - `stack-release.test.mjs`: 151/151 pass, 0 fail, rc 0, from 10:59:11Z to 11:04:14Z. The counts are awk sums over the spec log.\n- I ran four mutants against `^(T53|T54) ` (19 tests), each restored by `git checkout`. Afterwards the script was blob `2586a2a37cd2` and the tree had only the staged test file. The fail counts include the T54 parent.\n - M8, the brief's (`return 0` before the `fi` that ends the carried branch, :738): killed, 5 fail. T54 test 1 (chmod, symlink, removal) and test 2.\n - M9, the brief's (the `$REPO` cases dropped, :775): killed, 3 fail. T54 tests 3 and 4.\n - M10, the brief's (`proof_file_problem` skipped when PROOF_HEADER is empty, :759): killed, 5 fail. T54 test 1 x3 and test 2.\n - M11, mine (`realpath -e -s`, so the path isn't resolved through symlinks, :774): killed, 2 fail. T54 test 4 only. So test 4 pins the symlink resolution that test 3 can't.\n- Darkwing's run (151/151, the control, M8-M10) and Sage's gate (GATE_PASSED, sage-1283) are their receipts, not mine.\n\n### Checked against the brief\n\n- **Test 1.** Three subtests, each on a fresh `mk` stand-in: chmod 644, a symlink to a watched mode-600 file, and removal. Each one sets the pair with `activate B`, then:\n - checks that `--plan` for `activate C1` prints `proof: carried` and exactly one refusal, `proof-file-invalid` with the reason;\n - runs the real activate through `refused`;\n - checks that the pointer stays on B with the pair.\n- **Test 2.** A rollback from C1 to B (B's Console takes the pair) after chmod 644. Same shape, and the plan names `to: B`.\n- **Test 3.** A mode-600 file of the test's uid under the fixture `repo/proof-r188` refuses in the plan and the run with `is inside the repository or the copies`. The fixture repo is `realpathSync`'d tmp, never the checkout. `t.after` removes the directory.\n- **Test 4.** `e.root/repo-link.188` is a directory symlink into `repo/proof-r188`. The test asserts the given path isn't itself a symlink and isn't under `repo/`. My M11 shows the realpath step is what refuses it.\n- **Test 5.** Every subtest ends in `noLeak`. The swapped-in file `swap.188` is a watched proof file too.\n- **The script is unchanged**, and so are `webui-service.sh`, `docs/TOOLS.md` and `packages/webui`. P19 407 and 408 are not in this row.\n\n### Readings\n\nI agree with both.\n\n1. **\"No log line.\"** A precheck refusal has always written one `result: refused` line. Removing it would need a script change. `refused` pins one refused line and no unit, pointer or store change, which is what the brief protects.\n2. **The hard link before removal or the swap.** The script's view is the same: the path is gone, or it's a symlink. Without the link, inotify's `IN_IGNORED` on the freed inode would count as a read in the watch's tally. The kept link stays under `e.root`, which `noLeak` doesn't walk, and isn't in any run's output.\n\n### Notes\n\n- **N1** (script gap outside this row, doesn't block; mos-0959): the \"inside the repository\" check compares a physical `realpath` with a logical REPO.\n - `stack-release.sh` sets `REPO=\"$(pwd)\"` after `cd \"$(dirname \"$0\")/..\"` (:22-23), and `webui-service.sh:67` sets REPO with `cd ... && pwd`. Both are the logical path. The proof file's path is `realpath -e`, which is physical.\n - So when either script is invoked through a symlinked path, a file inside the repo isn't refused. `~/src/mosaic-stack-dev-test -> /mnt/storage/src/mosaic-stack` is one such path.\n - I probed the same pattern in my scratch: through the symlink it printed MISSED, and through the real path REFUSED. The copies side uses `realpath -m` and is fine.\n - Neither row 187's tests nor row 188's can see this, because the fixture base is `realpathSync`'d.\n - The fix is `pwd -P`, or a `realpath` on REPO, in both scripts, plus a test that runs the script through a symlinked checkout. Per mos-0959, Part B's run brief requires the physical path and PB3 checks `pwd -P` = `pwd`. The fix is filed after Part B.\n"} |