open/repo-mailbox
1
0
Fork 0
Code Issues Releases 2 Activity

fix(coord-send): reply mode claimed "marked handled" without checking

Browse source 
coord-send.sh ran coord-done under `>/dev/null 2>&1` and then printed the
handled claim unconditionally. Measured with a stub coord-done exiting 1:
the original stayed in the inbox, no archive/ was created, and coord-send
still exited 0 saying "marked handled" - a false success in the message
transport itself, which is why every reply had to be verified by hand.

The predicate is deliberately wider than the exit code: coord-done exits 0
when it archives nothing (an unknown name is idempotently fine by its own
contract), so an exit-code-only fix still certifies a message that never
moved. The check is exit 0 AND the original no longer being at
$COORD/$FROM/inbox/$REPLYTO - recomputed rather than reusing $REPLY_ORIG,
which resolves to the inbox OR the archive, so replying to an already
archived original moves nothing and must not warn.

Failure is exit 1, a new status: the reply WAS delivered and re-sending it
would duplicate it, so 2 stays the nothing-was-written status.

Selftest section 34 (14 checks, red first) pins all four cases: coord-done
fails outright, coord-done exits 0 without moving, the real happy path, and
an archive-path reply. coord-selftest 206 -> 220.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ett8uHMDLir6trFaMzrYRu
This commit is contained in:
Kjell Tore Guttormsen 2026-08-16 15:42:13 +02:00
commit 21e2873e21
3 changed files with 130 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

75
scripts/coord-selftest.sh
View file

@ -1014,6 +1014,81 @@ rre="$("$SEND" --from somerepo --reply-to "$rfn" --message "reply" 2>&1)"; rc=$?
[ "$rc" -eq 2 ]; check "retired: replying to a message FROM the retired address also refuses" $?
printf '%s' "$rre" | grep -q "catalog"; check "retired: the reply-path refusal also points at catalog" $?
# 34. Reply mode claims the original was handled - and the claim is asserted
# against GROUND TRUTH, not against the call having been made. coord-send
# invoked coord-done under `>/dev/null 2>&1` and then printed "marked handled"
# unconditionally: the review's stub-coord-done repro (docs/2026-08-14-
# confident-zero-review.md, finding 9) showed exit 0 plus a false success line
# while the original sat untouched in the inbox and no archive/ existed. That
# is a false success in the message TRANSPORT itself, which is why every reply
# this repo sent had to be verified by hand afterwards.
#
# THE PREDICATE IS DELIBERATELY WIDER THAN "CHECK THE EXIT CODE", and a later
# session must not narrow it back. coord-done exits 0 when it archives NOTHING
# (a name that is not in the inbox is idempotently fine, :54 and :70), so an
# exit-code-only check still certifies a message that never moved - case (b)
# below fails against that narrower fix and passes only against this one. The
# ground truth is the inbox path itself.
#
# The path recomputed here is `$COORD/$FROM/inbox/$REPLYTO`, NOT `$REPLY_ORIG`:
# that variable resolves to the inbox OR the archive (coord-send.sh:129-130),
# so replying to an already-archived original leaves the file exactly where
# `$REPLY_ORIG` points and a `[ ! -e "$REPLY_ORIG" ]` test would warn on every
# legitimate archive-path reply - case (d) pins that it does not.
#
# The stubbing works because coord-send resolves its sibling by `dirname $0`:
# a copy of the script in a scratch directory picks up whatever coord-done.sh
# sits next to it.
F9DIR="$(mktemp -d)"
SBOX="$(mktemp -d)"
cp "$SEND" "$SBOX/coord-send.sh" && chmod +x "$SBOX/coord-send.sh"
F9SEND="$SBOX/coord-send.sh"
CLAUDE_COORD_DIR="$F9DIR" "$F9SEND" --to f9repo --from f9sender --subject "orig" --message "F9-BODY" >/dev/null
f9base="$(basename "$(ls "$F9DIR"/f9repo/inbox/*.md 2>/dev/null | head -1)")"
[ -n "$f9base" ]; check "F9 setup: original delivered to f9repo" $?
# (a) coord-done FAILS outright. The reply is still delivered - that half was
# never in doubt - but the handled claim must not be printed, the failure must
# reach stderr, and the exit status must stop a caller from recording the debt
# as closed.
printf '#!/bin/bash\nexit 1\n' > "$SBOX/coord-done.sh"; chmod +x "$SBOX/coord-done.sh"
f9a="$(CLAUDE_COORD_DIR="$F9DIR" "$F9SEND" --from f9repo --reply-to "$f9base" --message "reply-a" 2>&1)"; f9a_rc=$?
printf '%s' "$f9a" | grep -q "delivered to f9sender"; check "F9(a): the reply itself is still delivered when coord-done fails" $?
printf '%s' "$f9a" | grep -q "marked handled"; [ $? -ne 0 ]; check "F9(a): no false 'marked handled' claim when coord-done exits nonzero" $?
printf '%s' "$f9a" | grep -qi "still pending"; check "F9(a): the failure is reported, naming the original as still pending" $?
[ "$f9a_rc" -ne 0 ]; check "F9(a): exit status is nonzero so a caller cannot record the debt as closed" $?
[ -e "$F9DIR/f9repo/inbox/$f9base" ]; check "F9(a): ground truth - the original really is still in the inbox" $?
# (b) coord-done exits 0 and moves NOTHING. This is the case an exit-code-only
# fix passes and this one must fail: coord-done's own contract exits 0 for a
# name it did not find, so the exit code alone cannot distinguish "closed" from
# "never touched".
printf '#!/bin/bash\nexit 0\n' > "$SBOX/coord-done.sh"; chmod +x "$SBOX/coord-done.sh"
f9b="$(CLAUDE_COORD_DIR="$F9DIR" "$F9SEND" --from f9repo --reply-to "$f9base" --message "reply-b" 2>&1)"; f9b_rc=$?
printf '%s' "$f9b" | grep -q "marked handled"; [ $? -ne 0 ]; check "F9(b): coord-done exiting 0 without moving the file is NOT accepted as handled" $?
[ "$f9b_rc" -ne 0 ]; check "F9(b): exit status is nonzero for the silent no-op too" $?
[ -e "$F9DIR/f9repo/inbox/$f9base" ]; check "F9(b): ground truth - the original is still in the inbox" $?
# (c) The real coord-done. The happy path is unchanged: the claim is printed,
# exit stays 0, and the file is where the claim says it is.
cp "$DONE" "$SBOX/coord-done.sh" && chmod +x "$SBOX/coord-done.sh"
f9c="$(CLAUDE_COORD_DIR="$F9DIR" "$F9SEND" --from f9repo --reply-to "$f9base" --message "reply-c" 2>&1)"; f9c_rc=$?
printf '%s' "$f9c" | grep -q "marked handled"; check "F9(c): the real coord-done still gets the handled claim" $?
[ "$f9c_rc" -eq 0 ]; check "F9(c): happy path still exits 0" $?
[ ! -e "$F9DIR/f9repo/inbox/$f9base" ] && [ -e "$F9DIR/f9repo/archive/$f9base" ]
check "F9(c): ground truth - the original moved from inbox to archive" $?
# (d) Reply to an ALREADY-archived original (coord-send.sh:130 resolves it
# there). coord-done archives nothing and exits 0, and that is correct: the
# message is handled. A predicate written against `$REPLY_ORIG` instead of the
# inbox path would warn here, on a reply that is entirely legitimate.
f9d="$(CLAUDE_COORD_DIR="$F9DIR" "$F9SEND" --from f9repo --reply-to "$f9base" --message "reply-d" 2>&1)"; f9d_rc=$?
[ "$f9d_rc" -eq 0 ]; check "F9(d): replying to an already-archived original still exits 0" $?
printf '%s' "$f9d" | grep -qi "still pending"; [ $? -ne 0 ]; check "F9(d): and does not warn - nothing is pending" $?
/bin/rm -rf "$F9DIR" "$SBOX" 2>/dev/null
echo "----"
echo "PASS=$PASS FAIL=$FAIL"
[ "$FAIL" -eq 0 ]