fix(ci): the pre-publish bashrs gate went red again — #3187 added two SEC010 to the file #3188 had just cleared, because bashrs never runs on a PR (PMAT-1098)

[noahgift]

The release gate went red again, four hours after it was cleared

scripts/dogfood.sh --phase pre-publish on ee76ee39c — the commit that carries #3188's own bashrs fix — returned NO-GO:

[FAIL] bashrs  2 SEC/DET/IDEM error(s) over 293 file(s): SEC010
NO-GO — these gates are RED (fix the root cause; never bypass)

Both findings are in scripts/check_roadmap_diff_additive.sh, at the two cd "$Q.clone" sites #3187 added to the self-test case table — landed four hours after #3188 cleared the previous nine, in the same file family, with nothing in between to catch them.

That gap is the real finding and it has its own issue. The bashrs gate lives inside scripts/dogfood.sh; no CI job runs bashrs on a pull request. So every PR can add SEC/DET/IDEM findings freely and they surface only when a release train reaches its pre-publish gate. This is the second time tonight that has stopped the 0.67.0 train.

The fix

The harness cd'd into the fixture clone so the script under test would see it as cwd. That requirement belongs to the inner shell, so it is now handed the directory and cds itself. Neither site contains a cd of this script's own any more, and the inner bash -c exits 2 if the directory is not usable.

What was measured, rather than assumed

Every alternative was tried against the real file with bashrs 7.3.0 before settling:

attempt	result
validate $Q where it is defined	still 2
validate immediately before each cd	still 2
cd -- form	still 2
cd "$TD" && cd <literal>	still 2
alias the path through a command substitution	worse, 2 → 4
move the cd into the inner shell	CLEAN

So the rule is not asking for a check here; it objects to this script performing the cd. Note its own message asks that paths "don't contain .. or start with /", while these are mktemp -d paths and are necessarily absolute.

bashrs fix must not be used on this file. It reported "fixed 21 issues" and corrupted the script: trap 'rm -rf -- "${TD:?}"' EXIT became trap "rm -rf -- "${TD:?}"" EXIT, and it swapped the quote characters inside five assert_row calls, turning valid code into broken code. Filed separately.

Discrimination and acceptance

Restore either cd and SEC010 returns at that exact line. With both moved inward:

check	result
check_roadmap_diff_additive.sh	CLEAN, no diagnostics of any code
full 293-file surface, the gate's own git ls-files enumeration	zero DET/SEC/IDEM; the 7 remaining SC10xx are the #226 class the gate suppresses
bash scripts/check_roadmap_diff_additive.sh --self-test	rc=0, 24/24 rows
the two rows whose cd moved	row 19 stacked merge_group entry at depth-1 -> deepened and row 20 stacked entry with deepening disabled (mutation): refused by name, both still ok
bash -n	clean

APR-RELEASE-001 session 2, ticket PMAT-1098. This unblocks T-2 for the 0.67.0 tag.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3194 head=958b8c618ca8a56d4da3cecfb5350aff7670269a verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.