PMAT-1098: the release gate went red a third time — #3068's fleet check carried a DET002 and a SEC010 that no PR check ran - #3198
Merged
Conversation
…ck carried a DET002 and a SEC010 that no PR check ran The 0.67.0 pre-publish dogfood is NO-GO on bashrs for the third time in one train, each time on a file a PR merged after the previous fix cleared the tree (#3196). This time scripts/cuda_rust_fleet_check.sh from #3068: DET002 on the receipt timestamp and SEC010 on the cd into --repo. Both fixes are mutation-tested on the real file with the dogfood's own invocation (bashrs lint --no-ignore --level error): - NOW derives from SOURCE_DATE_EPOCH with a wall-clock fallback, so a re-run can pin the receipt time; restoring the bare date brings DET002 back. - REPO (from REPO_ROOT or --repo) is refused before first use unless absolute and free of '..'; removing the guard brings SEC010 back. Both refusals are exercised. - --self-test still passes. Gating findings over the whole surface: 2 -> 0. Pmat-Ticket: PMAT-1098 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
noahgift
enabled auto-merge
September 13, 2026 06:04
|
§13.11 rung 1 — quorum shadow verdict Shadow mode: this records a verdict and merges nothing. A refusal |
6 tasks
noahgift
added a commit
to guyernest/aprender
that referenced
this pull request
Sep 13, 2026
…e 0.67.0 train three times on findings no PR check saw (paiml#3196) (paiml#3199) dogfood.sh's bashrs row is the only place the SEC/DET/IDEM filter ran, so a PR could add a finding freely and the train paid for it at the pre-publish gate: 17:33Z (paiml#3115, paiml#3127 -> fixed by paiml#3188), 20:58Z (paiml#3187 -> paiml#3194), 22:48Z (paiml#3068 -> paiml#3198). Three fixes round the merge queue while the tag waited. scripts/check_bashrs_gate.sh is that gate lifted out where the finding is cheap: same surface enumeration (git ls-files, N+1 receipt asserted), same positive control (a DET002 sentinel that must fire or the run is ENV/2), same code filter. Its --self-test carries a drift gate that greps dogfood.sh for the identical rule tuples, a classifier case table, a must-RED fixture repo built from the incident's exact construct (a --repo argument parsed into a variable and used in a subshell cd; cd "$1" alone is not flagged, measured), its must-GREEN twin carrying paiml#3198's validation, and a vacuity case (gitignored script -> exit 2, named). Measured on real trees: main @ 0b6f94c -> exit 1, names cuda_rust_fleet_check.sh:129 DET002 and :201 SEC010; paiml#3198's tree -> exit 0. 3 s over 294 files. Wired as a step of guard-cargo, which gate already requires. dogfood.sh is untouched in this change; consolidating its inline row onto this script is the follow-up named in paiml#3196. Pmat-Ticket: PMAT-1098 Co-authored-by: Noah Gift <claude@noahgift.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 0.67.0 pre-publish dogfood is NO-GO on bashrs for the third time in one train (#3196), each time on a file a PR merged after the previous fix cleared the tree. This time
scripts/cuda_rust_fleet_check.shfrom #3068.NOW=$(date -u …)for the receipt timestampSOURCE_DATE_EPOCH, wall-clock fallbackdatebrings DET002 backcd "$REPO"where REPO comes fromREPO_ROOT/--repo..Measured with the dogfood's own invocation (
bashrs lint --no-ignore --level error): gating findings over the 294-file surface 2 → 0.--self-testpasses; both refusals exercised (--repo relative/path,--repo /a/../b).Release train: the autopilot re-points at this PR's merge commit for the 0.67.0 pre-publish dogfood. T-4 publish stays attended.
Refs #3196, #3068, PMAT-1098.
🤖 Generated with Claude Code