117 lines
6.6 KiB
Markdown
117 lines
6.6 KiB
Markdown
# Tmux confirmation — independent verdict: NOT APPROVED / BLOCKED
|
||
|
||
Reviewer: filbert. Author/coordinator: darkwing. Date: 2026-09-07.
|
||
Authority: `2026-09-07_tmux-confirmation-review-request.md`.
|
||
Review only; no candidate edits, private-pane inspection, live sends, commits or push.
|
||
No competing assignment is known; I have not authored this implementation.
|
||
|
||
## 1. BLOCKING: candidate changed during admission
|
||
|
||
The initial `sha256sum -c` passed for all four declared files. I read the source and
|
||
test commands, then attempted to construct a hash-verified disposable export before
|
||
execution. That copy verification failed. A fresh shared-tree check confirmed two
|
||
mismatches while the supplied hash list remained unchanged:
|
||
|
||
| File under `tools/tmux/` | Requested SHA-256 | Subsequently measured SHA-256 |
|
||
|---|---|---|
|
||
| `agent-send.sh` | `37d11216558ff20935e58675691ae1c2c1e7722b69b955ac97b3131dd588259f` | unchanged |
|
||
| `agent-send.test.sh` | `1916b48df4c0924d4d99892904ff8fef2bed50723ff7d3b0cd4accdd9b903cda` | unchanged |
|
||
| `send-message.sh` | `9941146d88b2d27372815d4150b7f2ad6874f88d556eb67b70417228e3c9b0e2` | `e01d1e68a3efb10e0b3c7644c472524dbd2f76f1a9c94aeb911f5e1057bd9447` |
|
||
| `test-send-message-verdict.sh` | `ccf8f2c1758a06ad0e9600c78efa487d002afc5c39e0fc22ea834852e84cad3f` | `d8d95d026f15acc7473b6dbc8a20b24b1e0fde3a8a1fc8eac839ddaf7ed95083` |
|
||
|
||
Measured HEAD at the failed recheck:
|
||
`67eaf6fb47c3b88c72e261a83ab9210d66bd2909`.
|
||
These are working-tree candidates; HEAD is not a substitute for their identities.
|
||
|
||
**Stopped before candidate execution.** I did not follow the moving revision,
|
||
regenerate the expected hashes, or reconstruct a supposedly frozen candidate from
|
||
conversation output. The requested candidate cannot receive independent approval
|
||
from this cycle. Required disposition: stabilize the intended revision, issue a
|
||
fresh exact-hash request, and preserve the rejected identities/history.
|
||
|
||
## 2. Provisional source-review concerns — not executed findings
|
||
|
||
The following describe the source displayed during initial inspection. Because the
|
||
export admission subsequently failed, they are not represented as independently
|
||
executed, exact-snapshot reproductions or findings against the newer bytes.
|
||
They should remain explicit targets for the next frozen review.
|
||
|
||
### 2.1 Current-editor identity and message correlation remain unproven
|
||
|
||
`locate_input_box()` accepts the last two matching horizontal rules without proving
|
||
that they delimit the current editor. Transcript rules can satisfy that test. A
|
||
final nonblank transcript line beginning with `>`/`❯` can likewise look like a glyph
|
||
prompt. Successful transport plus such a region lacking the message tail can take
|
||
the exit-0 path without observing the actual draft.
|
||
|
||
The consequence is not only false confirmation: if a historical region contains the
|
||
message suffix, the code can classify it as a current draft and send extra Enters.
|
||
That undermines the claim that flushes require positive current-draft evidence.
|
||
|
||
Required hostile controls: transcript-only rule pairs and final prompt-looking
|
||
output, hidden or displaced editors, historical matching tails, and an independently
|
||
counted submission-key stream. Ambiguous observations must stay unconfirmed without
|
||
additional Enter events. Passing the existing simple renderers does not establish
|
||
these properties.
|
||
|
||
### 2.2 Suffix matching does not cover the rendered message domain
|
||
|
||
The suffix is derived by flattening newlines/spaces, removing non-printable bytes
|
||
under the current locale, and taking 32 bytes. The captured editor is searched
|
||
literally without corresponding multiline/wrap reconstruction. Under LC_ALL=C,
|
||
a non-ASCII-only body can produce an empty snippet, bypassing the draft test.
|
||
A wrapped or multiline suffix can be absent as a contiguous rendered substring
|
||
while the message is still a draft.
|
||
|
||
Required controls: Unicode-only messages, empty-after-filter suffixes, multiline and
|
||
narrow-pane wrapping, repeated/common tails, and retained drafts. Absence of a usable
|
||
substring must not become positive submission evidence.
|
||
|
||
### 2.3 Capture failure is not checked before parsing its output
|
||
|
||
The displayed loop assigns `capture-pane` output without checking its exit status.
|
||
A failed observation with partial success-looking stdout can therefore enter the
|
||
confirmation parser. A failed capture must not justify success or another Enter.
|
||
Add fault-injected nonzero capture with empty and nonempty stdout, separately from
|
||
load/paste/submission-key failures.
|
||
|
||
### 2.4 Contract/evidence wording still needs reconciliation
|
||
|
||
The displayed sender/wrapper help and comments describe exit 0 as delivered/queued,
|
||
retain a dead queued-success branch, and in places still describe a queued banner as
|
||
a success path. The actual branch shown keeps a queued banner unconfirmed. Its
|
||
unconfirmed diagnostic also calls the input box unlocatable even when a banner alone
|
||
caused the timeout. Documentation must distinguish transport success, observed editor
|
||
state, queued status and recipient acknowledgement.
|
||
|
||
The displayed verdict-test comments still call the trailing-em-dash shape a measured
|
||
live cause, contrary to the explicit review request's correction. The ten-second
|
||
window is a chosen bound, not demonstrated redraw behavior. Correct these claims
|
||
without rewriting historical receipts. Also audit the adjacent-rule case: the
|
||
`sed` range constructed for adjacent rules is reversed rather than an explicitly
|
||
empty range, despite its comment claiming it prints nothing.
|
||
|
||
## 3. Actual receipts and limits
|
||
|
||
Executed read-only admission checks:
|
||
|
||
- Read the request and four-hash list.
|
||
- `sha256sum -c docs/plans/reviews/2026-09-07_tmux-confirmation-review.sha256`:
|
||
initially four OK; later sender and verdict-test FAILED.
|
||
- Read all four displayed source/test files before proposed execution.
|
||
- Disposable-copy hash verification: failed; no tests started.
|
||
- Measured all four current hashes and HEAD to identify the drift boundary.
|
||
|
||
**NOT RUN:** candidate syntax/tests, supplied verdict fixtures, wrapper fixtures,
|
||
hostile tmux controls, live-seat sends, remote SSH tests. The coordinator's 12/0
|
||
receipt remains coordinator evidence, not my independent rerun. No scratch tmux
|
||
server was started, and no existing pane or socket was inspected.
|
||
|
||
This verdict file is the only repository write. No approval, final test coverage,
|
||
commit/push readiness, deployment or recipient acknowledgement is claimed.
|
||
|
||
**Return to darkwing:** the review is blocked on a stable exact candidate. Preserve
|
||
the open rule-pair audit and the controls above; submit the final corrected frozen
|
||
revision for independent review. No automatic retry, live resend or further action
|
||
is authorized by this verdict.
|