fix(infra): a failed measurement must never render as a reassuring value
Tier 3, all five the same defect class (Verifiseringsloven ansikt 4): a
broken or uninstrumented query returning a positive-looking null, consumed
as a fact about the world.
F5 coord-count.sh: a mailbox root that does not exist was byte-identical
to one where nobody has pending mail - zero lines, exit 0, silent
stderr. Now exit 3 + a named stderr line; an existing-but-empty root
stays a silent, clean 0. 3 rather than 2 because 2 already means "you
called me wrong" and this means "the world you named is not there".
F14 coord-count.sh: the header promised exit 0 unconditionally while
--exclude with no value already exited 2. Contract restated as
0/2/3 and pinned as a check on the help TEXT.
F6 board.sh: `git status | wc -l` yields 0 lines whether the tree is
clean or git refused to answer, so a failure printed DRT=0. Now "?",
and BOTH awk consumers handle it - --plan's free-capacity test
compares the field as a string against "0" (a "?" coerces to 0 in
arithmetic and would certify an unmeasured tree as free), and the SUM
roll-up names what it could not add.
F10 board.sh: a scan root that does not exist was skipped in silence and
the empty scan exited 0. Bad roots are now named on stderr; exit 3
only when NO root was scanned. A mix still exits 0 and prints the
board. Replaces an assertion that encoded this defect as a pass.
F13 pre-state-line-guard.mjs: MAX_LINES is overridable via
CLAUDE_STATE_MAX_LINES so the boundary is testable without hardcoding
120 twice. An unusable value denies by name rather than falling back
to the default - a limit that silently did not take effect is the
same defect one layer up.
Every design choice mutation-tested; every negative check carries a
known-positive control. Section 11's first cut was vacuously green (wrong
basename + unexported fixture path) - recorded in CLAUDE.md rather than
quietly fixed, and the section now asserts its own ground truth.
Denominator measured, not estimated: coord-inbox.sh:57 and
coord-order-inbox.sh:60/64 carry the same `|| exit 0` shape and are
deliberately left alone (injection path, prose output, must never fail a
SessionStart) - stated in CLAUDE.md as a bounded gap.
Suites: coord 230->242, board 281->300, guard 40->54, route 69, orders
110, npm 11/11. Verified under system bash 3.2, not just Homebrew 5.3.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
parent
3beef2a603
commit
d8fdeaa991
7 changed files with 606 additions and 16 deletions
|
|
@ -498,8 +498,13 @@ check "NESTE block of only a multi-line comment reports an empty block" $?
|
|||
|
||||
"$BOARD" --help >/dev/null 2>&1; check "--help exits 0" $?
|
||||
|
||||
# Unreadable root is a no-op, not a crash.
|
||||
"$BOARD" --roots "$ROOT/does-not-exist" >/dev/null 2>&1; check "missing root is a clean no-op" $?
|
||||
# A root that does not exist is NOT a clean no-op - it is an unmeasured scan,
|
||||
# and it used to be indistinguishable from an empty tree. Pinned in full by
|
||||
# section 26 below (F10); asserted here only as "it does not crash".
|
||||
mr_rc=0
|
||||
"$BOARD" --roots "$ROOT/does-not-exist" >/dev/null 2>&1 || mr_rc=$?
|
||||
[ "$mr_rc" -eq 3 ]
|
||||
check "missing root exits nonzero (3) without crashing" $?
|
||||
|
||||
# --- 8. The documented next-cost form IS the convention --------------------
|
||||
# The cost field is free text on purpose: the parser reads to ';' or '-->' so
|
||||
|
|
@ -2283,6 +2288,164 @@ check "known-positive: the process-inspection grep can find a planted pgrep call
|
|||
|
||||
/bin/rm -rf "$FLY_ROOT" 2>/dev/null
|
||||
|
||||
# --- 25. F6: a git FAILURE must not read as a clean tree -------------------
|
||||
# `git -C "$d" status --porcelain 2>/dev/null | wc -l` yields 0 lines whether
|
||||
# the tree is clean or git refused to answer at all, so DRT printed 0 and every
|
||||
# reader - the table, the SUM, and --plan's free-capacity test - took that as
|
||||
# "nothing uncommitted here". Verifiseringsloven ansikt 4 on our own tooling.
|
||||
#
|
||||
# The fixture is a REAL reachable shape, not a contrived one: a `.git` FILE
|
||||
# pointing at a worktree parent that no longer exists. Discovery tests `.git`
|
||||
# with -e precisely so worktrees are found (see board.sh's own comment), so
|
||||
# this directory IS scanned as a repo and `git status` exits 128 on it.
|
||||
# Measured before the fixture was written: rc=128, zero lines on stdout.
|
||||
F6ROOT="$(mktemp -d)"
|
||||
F6COORD="$(mktemp -d)"
|
||||
|
||||
# The known-positive controls come first and are the reason this section can
|
||||
# fail in both directions: if the fix widened "unknown" to cover healthy repos,
|
||||
# these go red while every negative check below stays green.
|
||||
mkrepo "$F6ROOT/f6-clean"
|
||||
{
|
||||
echo "# STATE - f6-clean"
|
||||
printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
|
||||
echo "<!-- board: status=done; blocked-on=-; next-cost=Sonnet 5/low -->"
|
||||
echo "Ingenting."
|
||||
} > "$F6ROOT/f6-clean/STATE.md"
|
||||
git -C "$F6ROOT/f6-clean" add -A >/dev/null 2>&1
|
||||
git -C "$F6ROOT/f6-clean" -c user.email=t@t -c user.name=t commit -qm init >/dev/null 2>&1
|
||||
|
||||
mkrepo "$F6ROOT/f6-dirty"
|
||||
{
|
||||
echo "# STATE - f6-dirty"
|
||||
printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
|
||||
echo "<!-- board: status=done; blocked-on=-; next-cost=Sonnet 5/low -->"
|
||||
echo "Ingenting."
|
||||
} > "$F6ROOT/f6-dirty/STATE.md"
|
||||
git -C "$F6ROOT/f6-dirty" add -A >/dev/null 2>&1
|
||||
git -C "$F6ROOT/f6-dirty" -c user.email=t@t -c user.name=t commit -qm init >/dev/null 2>&1
|
||||
echo "uncommitted" > "$F6ROOT/f6-dirty/scratch.txt"
|
||||
|
||||
# The defect case: scanned as a repo, but git cannot answer.
|
||||
mkdir -p "$F6ROOT/f6-broken"
|
||||
echo "gitdir: $F6ROOT/f6-broken-parent-that-does-not-exist/.git/worktrees/x" \
|
||||
> "$F6ROOT/f6-broken/.git"
|
||||
{
|
||||
echo "# STATE - f6-broken"
|
||||
printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
|
||||
echo "<!-- board: status=done; blocked-on=-; next-cost=Sonnet 5/low -->"
|
||||
echo "Ingenting."
|
||||
} > "$F6ROOT/f6-broken/STATE.md"
|
||||
|
||||
# Ground truth for the fixture itself, so a later git version that starts
|
||||
# answering here fails THIS check rather than silently disarming the section.
|
||||
git -C "$F6ROOT/f6-broken" status --porcelain >/dev/null 2>&1
|
||||
[ $? -ne 0 ]
|
||||
check "F6: fixture ground truth - git really does fail on the broken worktree" $?
|
||||
|
||||
F6TBL="$(CLAUDE_COORD_DIR="$F6COORD" "$BOARD" --roots "$F6ROOT" 2>/dev/null)"
|
||||
|
||||
# DRT is counted from the RIGHT (NF-3: DRT ALDER SISTE NESTE), never from the
|
||||
# left: the KOST field is free text and its realistic spelling ("Sonnet 5/low")
|
||||
# contains a space, so $7 reads FLY instead. Measured, not assumed - the first
|
||||
# cut of this section passed its clean-tree control by accident that way.
|
||||
printf '%s' "$F6TBL" | grep -E '^f6-clean[[:space:]]' | awk '{print $(NF-3)}' | grep -qx '0'
|
||||
check "F6: control - a healthy CLEAN tree still reads DRT 0" $?
|
||||
printf '%s' "$F6TBL" | grep -E '^f6-dirty[[:space:]]' | awk '{print $(NF-3)}' | grep -qx '1'
|
||||
check "F6: control - a healthy DIRTY tree still reads DRT 1" $?
|
||||
|
||||
printf '%s' "$F6TBL" | grep -E '^f6-broken[[:space:]]' | awk '{print $(NF-3)}' | grep -qx '0'
|
||||
[ $? -ne 0 ]
|
||||
check "F6: a git failure does NOT read as DRT 0 (clean tree)" $?
|
||||
printf '%s' "$F6TBL" | grep -E '^f6-broken[[:space:]]' | awk '{print $(NF-3)}' | grep -qx '?'
|
||||
check "F6: a git failure reads as ? (not measured), the same token coord-count uses" $?
|
||||
|
||||
# The load-bearing consequence. All three fixtures are status=done with no mail
|
||||
# and no orders, so the ONLY thing separating them is the tree reading. A repo
|
||||
# whose tree could not be measured is not provably free, and certifying it free
|
||||
# is how an unmeasured null becomes a fact about the world.
|
||||
F6PLAN="$(CLAUDE_COORD_DIR="$F6COORD" "$BOARD" --roots "$F6ROOT" --plan 2>/dev/null)"
|
||||
printf '%s' "$F6PLAN" | grep -q '^ledig=f6-clean '
|
||||
check "F6: control - the clean done repo IS still reported as free capacity" $?
|
||||
printf '%s' "$F6PLAN" | grep -q '^ledig=f6-dirty '
|
||||
[ $? -ne 0 ]
|
||||
check "F6: control - the dirty done repo is still NOT free capacity" $?
|
||||
printf '%s' "$F6PLAN" | grep -q '^ledig=f6-broken '
|
||||
[ $? -ne 0 ]
|
||||
check "F6: an unmeasurable tree is NOT certified as free capacity" $?
|
||||
|
||||
# The SUM line adds field 7 across every repo. An unknown adds 0 there, which
|
||||
# silently understates the total under a heading the operator reads as counted.
|
||||
# It must be NAMED, on the same principle --plan already applies to repos with
|
||||
# no board line: labelled, never silently dropped.
|
||||
printf '%s' "$F6TBL" | grep -q 'MERK: 1 repo har umaalbart arbeidstre'
|
||||
check "F6: the SUM roll-up names the repo whose tree could not be measured" $?
|
||||
printf '%s' "$F6TBL" | grep -qE 'SUM: [0-9]+ uhaandterte innboks-meldinger, 1 ukommiterte filer'
|
||||
check "F6: control - the SUM still counts the one real uncommitted file" $?
|
||||
|
||||
/bin/rm -rf "$F6ROOT" "$F6COORD" 2>/dev/null
|
||||
|
||||
# --- 26. F10: a scan root that does not exist is not an empty tree ----------
|
||||
# `[ -d "$root" ] || continue` skipped a bad root silently, and a scan that
|
||||
# found no repo at all then exited 0 printing nothing - so a typo in --roots,
|
||||
# a moved home directory and a genuinely empty tree were one single output.
|
||||
# This section REPLACES the older "missing root is a clean no-op" assertion,
|
||||
# which encoded exactly this defect as a passing test.
|
||||
F10ROOT="$(mktemp -d)"
|
||||
F10COORD="$(mktemp -d)"
|
||||
mkrepo "$F10ROOT/f10-repo"
|
||||
{
|
||||
echo "# STATE - f10-repo"
|
||||
printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
|
||||
echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/low -->"
|
||||
echo "Et steg."
|
||||
} > "$F10ROOT/f10-repo/STATE.md"
|
||||
|
||||
# Known-positive control FIRST: a valid root still scans, still exits 0, and -
|
||||
# critically - still says NOTHING on stderr. A warning on the ordinary path
|
||||
# would train every reader to ignore the channel the defect case needs.
|
||||
f10a_err="${TMPDIR:-/tmp}/f10a.err.$$"
|
||||
f10a_out="$(CLAUDE_COORD_DIR="$F10COORD" "$BOARD" --roots "$F10ROOT" 2>"$f10a_err")"; f10a_rc=$?
|
||||
[ "$f10a_rc" -eq 0 ] && printf '%s' "$f10a_out" | grep -q 'f10-repo' && [ ! -s "$f10a_err" ]
|
||||
check "F10: control - a valid root scans, exits 0, and warns about nothing" $?
|
||||
|
||||
# An EXISTING but empty root is the genuine "no repos here" answer and must
|
||||
# stay a silent, clean 0 - it is the reading the defect case used to be
|
||||
# indistinguishable from.
|
||||
F10EMPTY="$(mktemp -d)"
|
||||
f10b_err="${TMPDIR:-/tmp}/f10b.err.$$"
|
||||
f10b_out="$(CLAUDE_COORD_DIR="$F10COORD" "$BOARD" --roots "$F10EMPTY" 2>"$f10b_err")"; f10b_rc=$?
|
||||
[ "$f10b_rc" -eq 0 ] && [ -z "$f10b_out" ] && [ ! -s "$f10b_err" ]
|
||||
check "F10: control - an existing but EMPTY root is a silent, clean 0" $?
|
||||
|
||||
# The defect: the root is not there at all.
|
||||
f10c_err="${TMPDIR:-/tmp}/f10c.err.$$"
|
||||
f10c_out="$(CLAUDE_COORD_DIR="$F10COORD" "$BOARD" --roots "$F10ROOT/no-such-dir" 2>"$f10c_err")"; f10c_rc=$?
|
||||
[ "$f10c_rc" -eq 3 ]
|
||||
check "F10: a scan root that does not exist exits 3, not 0" $?
|
||||
[ -z "$f10c_out" ]
|
||||
check "F10: a missing root prints no board (3 is not an empty board)" $?
|
||||
grep -q 'no-such-dir' "$f10c_err"
|
||||
check "F10: the missing root is NAMED on stderr, not merely counted" $?
|
||||
[ "$f10b_rc" -ne "$f10c_rc" ]
|
||||
check "F10: empty root and missing root no longer report the same status" $?
|
||||
|
||||
# A MIX is the case that decides whether this is a warning or a failure: some
|
||||
# repos really were scanned, so the board is real and must be printed - but the
|
||||
# reader must still learn that one root contributed nothing because it is not
|
||||
# there, rather than because it is empty.
|
||||
f10d_err="${TMPDIR:-/tmp}/f10d.err.$$"
|
||||
f10d_out="$(CLAUDE_COORD_DIR="$F10COORD" "$BOARD" --roots "$F10ROOT,$F10ROOT/no-such-dir" 2>"$f10d_err")"; f10d_rc=$?
|
||||
[ "$f10d_rc" -eq 0 ]
|
||||
check "F10: one good root among bad ones still exits 0 - the board is real" $?
|
||||
printf '%s' "$f10d_out" | grep -q 'f10-repo'
|
||||
check "F10: the good root's repos are still scanned when a sibling root is bad" $?
|
||||
grep -q 'no-such-dir' "$f10d_err"
|
||||
check "F10: the bad root is still named on stderr in the mixed case" $?
|
||||
|
||||
/bin/rm -rf "$F10ROOT" "$F10COORD" "$F10EMPTY" "$f10a_err" "$f10b_err" \
|
||||
"$f10c_err" "$f10d_err" 2>/dev/null
|
||||
|
||||
echo ""
|
||||
echo "board-selftest: $PASS passed, $FAIL failed"
|
||||
[ "$FAIL" -eq 0 ] || exit 1
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue