The sweep the §12 work called for, run over every test reading a static repo
document. Enumerated population: four such guards (method-spec, ingest-spec,
README, pyproject). Three were already sound — the two spec guards were
anchored in sessions 14/15, and the README guard extracts flags by regex and
cross-checks them against real --help output with explicit vacuity guards.
The fourth was green-but-dead, and it was MEASURED, not inferred:
`assert _PIN in _PYPROJECT.read_text()` stayed GREEN (4 passed) while the real
dependency drifted to >=0.2.110 below the guard's own verified floor, because
the literal survived in a trailing comment. The comment above it claimed
"Detach-proof: the pin and this guard cannot drift apart silently" — the exact
drift it named is what it let through.
Three narrowings, each one a measured degeneration rather than a precaution:
- ANCHOR: match inside the `dependencies = [...]` array, fail-closed with
ValueError when the array is renamed (a silently empty slice would make
every assertion vacuous).
- QUOTED FORM: the slice alone still did not detach — a comment sits inside
the array too. Requiring `"<pin>"` with comments stripped does.
- VALUE BINDING: _PIN is now DERIVED from _VERIFIED_FLOOR/_CEILING via
_pin_for(), so the range this guard enforces and the pin it demands cannot
part company. The error message derives from it too, instead of carrying a
third hand-maintained copy that could lie.
Five permanent red-proofs replace the manual spot-check, all run against a
mutated COPY of the text, never pyproject.toml itself. Measured degeneracy:
substring-anywhere restored -> 1 red; anchor widened to the whole file -> 2
red; the derived-pin binding severed -> 2 red.
Suite 683 -> 688; ruff, format and mypy clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FcKMxznPVR9zfdsdu5Ztdn
- File-layer decision vocabulary (§4.2 set) with SKIP semantics — an unknown
decision never reaches the store (C-F7, the review's run proof is the fixture)
- Fail-fast caps (max_files / max_rationale_chars) via InboxLimitError raised
OUTSIDE the tolerant try — a cap breach is never swallowed as a skip
- R-6 id grammar (mirrors ingest _ID_RE) as a pydantic pattern on
VerdictDocument.id AND re-checked in write_verdict, since model_copy(update=)
bypasses model validation — traversal ids can no longer write outside the inbox
- promotion._filename_token: any sanitised id maps to a content hash — 'e/vil'
can no longer clobber the distinct id 'evil' (restarbeid-funn 2)
- SDK pinned >=0.2.111,<0.3 + version guard test naming the sdk_client.py
attribute premises; resolved 0.2.120, all premises re-verified against it
- sdk_client read loop bound offline with REAL SDK message types (R-4/R-5):
text aggregation, error fail-paths, usage/cost extraction, _total_tokens
fail-closed, non-positive budget guard
- test_sdk_isolation comment no longer claims the --system-prompt ""
serialization the test body does not bind (honesty rule §1)
Guard-G2 assessment (guard-plan §4): the allowlist + caps + id grammar landed
here are G2's necessary part; an optional scan_output depth pass over
rationale (still a verbatim prose channel into the fold prompt, R-9) remains
relevant as a later additive session — the trigger picture is unchanged.
4 detach proofs red → restored green. Full gate: 389 passed (365→389),
ruff+format+mypy clean; golden + shared/ + runs/s10/ byte-untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
