Bastien ChanotandClaude Opus 4.8
1c69de2f40
ship-feature: STEP 0e CONTRACT (request verbatim) → ENRICHED at the STEP 3 validation gate (design criteria appended [gated <date>], the human micro-gate) → STEP 5 VERIFY+SECURE judges the branch against the ENRICHED contract via the shared include. Distinct axis from STEP 6 code review, both run (LRN-095). init-project: contract seeded from the PROJECT BRIEF (V1 features → criteria) → ENRICHED at VALIDATION GATE #1 → STEP 9 VERIFY+SECURE. Adds the security gate init-project previously lacked (was deferred to a later /onboard). onboard: explicit NO verify-loop — it produces an audit report, not a change to verify against a request; contract is scope-only, security-auditor runs MODE audit (report-only), never a gate. Documented to prevent a misplaced symmetry loop (BDR-050: dev pipeline != audit). lib/tests/no-vacuous-locks.test.sh: deterministic backstop for LRN-093 (2nd recurrence in this chantier → the advisory alone did not hold). Refuses a literal \n in any grep/tf/tr_/tn pattern across lib/tests/*.test.sh; flip-tested against a synthetic offender so the guard proves it bites. lib/tests/loops-heavy.test.sh: 18 structure locks green. Behavioral dogfood (both vigilance points, real): (1) enrichment — a fresh verifier reads and checks a [gated] design criterion (ECARTS naming it precisely); (2) escalation — 3 consecutive ECARTS on the same criterion → orchestrator STOPs at the max-3 bound + presents the CONTRACT-vs-REALIZED table, no 4th loop, no commit. First real exercise of the infinite-loop guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS
56 lines
2.2 KiB
Bash
56 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
# ============================================================
|
|
# Deterministic backstop for LRN-093 (vacuous grep locks).
|
|
# grep NEVER interprets a literal \n as a newline: in a -F
|
|
# fixed string it splits the pattern into a per-line OR (matches
|
|
# anything); in -E it is a literal "n". Either way a structure
|
|
# lock carrying \n proves nothing. The LRN advisory alone did not
|
|
# hold (2 recurrences same chantier) -> this mechanical guard.
|
|
#
|
|
# Rule: no backslash-n inside a quoted pattern on a grep / tf /
|
|
# tr_ / tn line, anywhere under lib/tests/*.test.sh. Flip-tested
|
|
# below against a synthetic offender so the guard proves it bites.
|
|
# ============================================================
|
|
set -u
|
|
|
|
REPO="$(cd "$(dirname "$0")/../.." && pwd)"
|
|
SELF="no-vacuous-locks.test.sh"
|
|
FAIL=0
|
|
|
|
# One scanner, reused for the real tree and the flip-test fixture.
|
|
# Matches a grep -*F/-*E call OR a tf/tr_/tn helper (at line start or after
|
|
# whitespace) whose quoted pattern contains a literal backslash-n.
|
|
scan() { # scan <dir containing *.test.sh>
|
|
grep -rnE '(grep +-[A-Za-z]*[EFqe]|(^|[[:space:]])(tf|tr_|tn)[[:space:]]).*"[^"]*\\n' \
|
|
"$1"/*.test.sh 2>/dev/null | grep -v "$SELF"
|
|
}
|
|
|
|
echo "-- LRN-093 backstop: scan lib/tests/*.test.sh --"
|
|
HITS="$(scan "$REPO/lib/tests")"
|
|
if [ -n "$HITS" ]; then
|
|
FAIL=1
|
|
printf '%s\n' "$HITS" | while IFS= read -r line; do
|
|
printf ' FAIL vacuous backslash-n lock: %s\n' "$line"
|
|
done
|
|
else
|
|
printf ' PASS no vacuous backslash-n locks in lib/tests/*.test.sh\n'
|
|
fi
|
|
|
|
# Flip-test: the guard MUST catch a known offender (LRN-093 discipline —
|
|
# prove a lock CAN fail before trusting its green).
|
|
echo "-- flip-test: guard bites a synthetic offender --"
|
|
TMP="$(mktemp -d)"
|
|
# shellcheck disable=SC2016 # the single quotes are deliberate: literal backslash-n
|
|
printf '%s\n' 'tf "bad" "$F" "no\nforced loop"' > "$TMP/z.test.sh"
|
|
if [ -n "$(scan "$TMP")" ]; then
|
|
printf ' PASS guard catches the synthetic offender\n'
|
|
else
|
|
printf ' FAIL guard blind to a known offender (regex too weak)\n'
|
|
FAIL=1
|
|
fi
|
|
rm -rf "$TMP"
|
|
|
|
echo ""
|
|
if [ "$FAIL" -eq 0 ]; then echo "no-vacuous-locks: clean"; else echo "no-vacuous-locks: vacuous locks present"; fi
|
|
[ "$FAIL" -eq 0 ]
|