Files
stack/docs/plans/reviews/2026-09-07_tmux-confirmation-verdict.md
T

6.6 KiB
Raw Blame History

Tmux confirmation — independent verdict: NOT APPROVED / BLOCKED

Reviewer: filbert. Author/coordinator: darkwing. Date: 2026-09-07. Authority: 2026-09-07_tmux-confirmation-review-request.md. Review only; no candidate edits, private-pane inspection, live sends, commits or push. No competing assignment is known; I have not authored this implementation.

1. BLOCKING: candidate changed during admission

The initial sha256sum -c passed for all four declared files. I read the source and test commands, then attempted to construct a hash-verified disposable export before execution. That copy verification failed. A fresh shared-tree check confirmed two mismatches while the supplied hash list remained unchanged:

File under tools/tmux/ Requested SHA-256 Subsequently measured SHA-256
agent-send.sh 37d11216558ff20935e58675691ae1c2c1e7722b69b955ac97b3131dd588259f unchanged
agent-send.test.sh 1916b48df4c0924d4d99892904ff8fef2bed50723ff7d3b0cd4accdd9b903cda unchanged
send-message.sh 9941146d88b2d27372815d4150b7f2ad6874f88d556eb67b70417228e3c9b0e2 e01d1e68a3efb10e0b3c7644c472524dbd2f76f1a9c94aeb911f5e1057bd9447
test-send-message-verdict.sh ccf8f2c1758a06ad0e9600c78efa487d002afc5c39e0fc22ea834852e84cad3f d8d95d026f15acc7473b6dbc8a20b24b1e0fde3a8a1fc8eac839ddaf7ed95083

Measured HEAD at the failed recheck: 67eaf6fb47c3b88c72e261a83ab9210d66bd2909. These are working-tree candidates; HEAD is not a substitute for their identities.

Stopped before candidate execution. I did not follow the moving revision, regenerate the expected hashes, or reconstruct a supposedly frozen candidate from conversation output. The requested candidate cannot receive independent approval from this cycle. Required disposition: stabilize the intended revision, issue a fresh exact-hash request, and preserve the rejected identities/history.

2. Provisional source-review concerns — not executed findings

The following describe the source displayed during initial inspection. Because the export admission subsequently failed, they are not represented as independently executed, exact-snapshot reproductions or findings against the newer bytes. They should remain explicit targets for the next frozen review.

2.1 Current-editor identity and message correlation remain unproven

locate_input_box() accepts the last two matching horizontal rules without proving that they delimit the current editor. Transcript rules can satisfy that test. A final nonblank transcript line beginning with >/ can likewise look like a glyph prompt. Successful transport plus such a region lacking the message tail can take the exit-0 path without observing the actual draft.

The consequence is not only false confirmation: if a historical region contains the message suffix, the code can classify it as a current draft and send extra Enters. That undermines the claim that flushes require positive current-draft evidence.

Required hostile controls: transcript-only rule pairs and final prompt-looking output, hidden or displaced editors, historical matching tails, and an independently counted submission-key stream. Ambiguous observations must stay unconfirmed without additional Enter events. Passing the existing simple renderers does not establish these properties.

2.2 Suffix matching does not cover the rendered message domain

The suffix is derived by flattening newlines/spaces, removing non-printable bytes under the current locale, and taking 32 bytes. The captured editor is searched literally without corresponding multiline/wrap reconstruction. Under LC_ALL=C, a non-ASCII-only body can produce an empty snippet, bypassing the draft test. A wrapped or multiline suffix can be absent as a contiguous rendered substring while the message is still a draft.

Required controls: Unicode-only messages, empty-after-filter suffixes, multiline and narrow-pane wrapping, repeated/common tails, and retained drafts. Absence of a usable substring must not become positive submission evidence.

2.3 Capture failure is not checked before parsing its output

The displayed loop assigns capture-pane output without checking its exit status. A failed observation with partial success-looking stdout can therefore enter the confirmation parser. A failed capture must not justify success or another Enter. Add fault-injected nonzero capture with empty and nonempty stdout, separately from load/paste/submission-key failures.

2.4 Contract/evidence wording still needs reconciliation

The displayed sender/wrapper help and comments describe exit 0 as delivered/queued, retain a dead queued-success branch, and in places still describe a queued banner as a success path. The actual branch shown keeps a queued banner unconfirmed. Its unconfirmed diagnostic also calls the input box unlocatable even when a banner alone caused the timeout. Documentation must distinguish transport success, observed editor state, queued status and recipient acknowledgement.

The displayed verdict-test comments still call the trailing-em-dash shape a measured live cause, contrary to the explicit review request's correction. The ten-second window is a chosen bound, not demonstrated redraw behavior. Correct these claims without rewriting historical receipts. Also audit the adjacent-rule case: the sed range constructed for adjacent rules is reversed rather than an explicitly empty range, despite its comment claiming it prints nothing.

3. Actual receipts and limits

Executed read-only admission checks:

  • Read the request and four-hash list.
  • sha256sum -c docs/plans/reviews/2026-09-07_tmux-confirmation-review.sha256: initially four OK; later sender and verdict-test FAILED.
  • Read all four displayed source/test files before proposed execution.
  • Disposable-copy hash verification: failed; no tests started.
  • Measured all four current hashes and HEAD to identify the drift boundary.

NOT RUN: candidate syntax/tests, supplied verdict fixtures, wrapper fixtures, hostile tmux controls, live-seat sends, remote SSH tests. The coordinator's 12/0 receipt remains coordinator evidence, not my independent rerun. No scratch tmux server was started, and no existing pane or socket was inspected.

This verdict file is the only repository write. No approval, final test coverage, commit/push readiness, deployment or recipient acknowledgement is claimed.

Return to darkwing: the review is blocked on a stable exact candidate. Preserve the open rule-pair audit and the controls above; submit the final corrected frozen revision for independent review. No automatic retry, live resend or further action is authorized by this verdict.