docs(testing): proactive bug-finding harness + 2026-07-16 audit (11 confirmed)

[bussyjd]

Proactive bug-finding harness — how we find operator-sequence bugs before operators do

Follow-up to the Canary402 field report. Every one of those 10 bugs was found by an operator doing a reasonable-but-unanticipated sequence on a live deployment — none were happy-path failures — which is why example-based unit tests missed them and a human found them first.

This PR documents the one approach that finds that class automatically (a synthetic operator driving generated sequences, checked against invariants rather than hand-written expectations) as four layers, and adds two runnable artifacts:

• docs/testing/proactive-bug-finding.md — the six invariants, the four layers (invariant oracles → stateful model tests → nightly canary cluster → agent audit), how to run each, and why it beats more unit tests.
• .claude/workflows/obol-audit.js — the reusable layer-4 workflow: N hostile-operator lenses fan out, each candidate is checked by two independent adversarial refuters, output is the ranked confirmed survivors. Re-run with Workflow({ name: "obol-audit", args: { known: [...already-fixed...] } }).
• hack/canary/run-canary.sh — the layer-3 ephemeral-k3s scenario-matrix skeleton (real CLI + black-box invariant probes; fail-loud for nightly CI). Cluster bring-up and the on-chain scenarios are marked TODO for your environment.

First run — 2026-07-16 (recorded in the doc)

Layer 4 was run against integration with all six field-report fixes merged, so it hunted for new bugs. 8 lenses × 2 refuters → 11 confirmed (3 rejected by a refuter, correctly). The layer-1 name-injectivity oracle independently found the same #1 grant-collision bug the agent sweep did — two methods, one bug.

Two of the eleven are already handled: the critical unvalidated-price bug (separate PR) and the ReferenceGrant dash-collision (folded into #767). The doc's triage table lists the remaining nine confirmed findings (four of them the same status-truth invariant broken in new places) as an actionable worklist.

Docs + tooling only — no production code changes.

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

[bussyjd]

Superseded by #778, which removes these internal tooling/docs from the production repo entirely (they don't belong in the shipped product, and the findings tables risked disclosing open issues on public main). The one durable artifact — the name_injectivity_test.go regression test — is retained via #767. Closing in favor of #778.

[bussyjd]

Proactive bug-finding harness — how we find operator-sequence bugs before operators do

Follow-up to the Canary402 field report. Every one of those 10 bugs was found by an operator doing a reasonable-but-unanticipated sequence on a live deployment — none were happy-path failures — which is why example-based unit tests missed them and a human found them first.

This PR documents the one approach that finds that class automatically (a synthetic operator driving generated sequences, checked against invariants rather than hand-written expectations) as four layers, and adds two runnable artifacts:

• docs/testing/proactive-bug-finding.md — the six invariants, the four layers (invariant oracles → stateful model tests → nightly canary cluster → agent audit), how to run each, and why it beats more unit tests.
• .claude/workflows/obol-audit.js — the reusable layer-4 workflow: N hostile-operator lenses fan out, each candidate is checked by two independent adversarial refuters, output is the ranked confirmed survivors. Re-run with Workflow({ name: "obol-audit", args: { known: [...already-fixed...] } }).
• hack/canary/run-canary.sh — the layer-3 ephemeral-k3s scenario-matrix skeleton (real CLI + black-box invariant probes; fail-loud for nightly CI). Cluster bring-up and the on-chain scenarios are marked TODO for your environment.

First run — 2026-07-16 (recorded in the doc)

Layer 4 was run against integration with all six field-report fixes merged, so it hunted for new bugs. 8 lenses × 2 refuters → 11 confirmed (3 rejected by a refuter, correctly). The layer-1 name-injectivity oracle independently found the same #1 grant-collision bug the agent sweep did — two methods, one bug.

Two of the eleven are already handled: the critical unvalidated-price bug (separate PR) and the ReferenceGrant dash-collision (folded into #767). The doc's triage table lists the remaining nine confirmed findings (four of them the same status-truth invariant broken in new places) as an actionable worklist.

Docs + tooling only — no production code changes.

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

[bussyjd]

Superseded by #778, which removes these internal tooling/docs from the production repo entirely (they don't belong in the shipped product, and the findings tables risked disclosing open issues on public main). The one durable artifact — the name_injectivity_test.go regression test — is retained via #767. Closing in favor of #778.

[bussyjd]

Proactive bug-finding harness — how we find operator-sequence bugs before operators do

Follow-up to the Canary402 field report. Every one of those 10 bugs was found by an operator doing a reasonable-but-unanticipated sequence on a live deployment — none were happy-path failures — which is why example-based unit tests missed them and a human found them first.

This PR documents the one approach that finds that class automatically (a synthetic operator driving generated sequences, checked against invariants rather than hand-written expectations) as four layers, and adds two runnable artifacts:

• docs/testing/proactive-bug-finding.md — the six invariants, the four layers (invariant oracles → stateful model tests → nightly canary cluster → agent audit), how to run each, and why it beats more unit tests.
• .claude/workflows/obol-audit.js — the reusable layer-4 workflow: N hostile-operator lenses fan out, each candidate is checked by two independent adversarial refuters, output is the ranked confirmed survivors. Re-run with Workflow({ name: "obol-audit", args: { known: [...already-fixed...] } }).
• hack/canary/run-canary.sh — the layer-3 ephemeral-k3s scenario-matrix skeleton (real CLI + black-box invariant probes; fail-loud for nightly CI). Cluster bring-up and the on-chain scenarios are marked TODO for your environment.

First run — 2026-07-16 (recorded in the doc)

Layer 4 was run against integration with all six field-report fixes merged, so it hunted for new bugs. 8 lenses × 2 refuters → 11 confirmed (3 rejected by a refuter, correctly). The layer-1 name-injectivity oracle independently found the same #1 grant-collision bug the agent sweep did — two methods, one bug.

Two of the eleven are already handled: the critical unvalidated-price bug (separate PR) and the ReferenceGrant dash-collision (folded into #767). The doc's triage table lists the remaining nine confirmed findings (four of them the same status-truth invariant broken in new places) as an actionable worklist.

Docs + tooling only — no production code changes.

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

[bussyjd]

Superseded by #778, which removes these internal tooling/docs from the production repo entirely (they don't belong in the shipped product, and the findings tables risked disclosing open issues on public main). The one durable artifact — the name_injectivity_test.go regression test — is retained via #767. Closing in favor of #778.

[bussyjd]

Proactive bug-finding harness — how we find operator-sequence bugs before operators do

Follow-up to the Canary402 field report. Every one of those 10 bugs was found by an operator doing a reasonable-but-unanticipated sequence on a live deployment — none were happy-path failures — which is why example-based unit tests missed them and a human found them first.

This PR documents the one approach that finds that class automatically (a synthetic operator driving generated sequences, checked against invariants rather than hand-written expectations) as four layers, and adds two runnable artifacts:

• docs/testing/proactive-bug-finding.md — the six invariants, the four layers (invariant oracles → stateful model tests → nightly canary cluster → agent audit), how to run each, and why it beats more unit tests.
• .claude/workflows/obol-audit.js — the reusable layer-4 workflow: N hostile-operator lenses fan out, each candidate is checked by two independent adversarial refuters, output is the ranked confirmed survivors. Re-run with Workflow({ name: "obol-audit", args: { known: [...already-fixed...] } }).
• hack/canary/run-canary.sh — the layer-3 ephemeral-k3s scenario-matrix skeleton (real CLI + black-box invariant probes; fail-loud for nightly CI). Cluster bring-up and the on-chain scenarios are marked TODO for your environment.

First run — 2026-07-16 (recorded in the doc)

Layer 4 was run against integration with all six field-report fixes merged, so it hunted for new bugs. 8 lenses × 2 refuters → 11 confirmed (3 rejected by a refuter, correctly). The layer-1 name-injectivity oracle independently found the same #1 grant-collision bug the agent sweep did — two methods, one bug.

Two of the eleven are already handled: the critical unvalidated-price bug (separate PR) and the ReferenceGrant dash-collision (folded into #767). The doc's triage table lists the remaining nine confirmed findings (four of them the same status-truth invariant broken in new places) as an actionable worklist.

Docs + tooling only — no production code changes.

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

[bussyjd]

Superseded by #778, which removes these internal tooling/docs from the production repo entirely (they don't belong in the shipped product, and the findings tables risked disclosing open issues on public main). The one durable artifact — the name_injectivity_test.go regression test — is retained via #767. Closing in favor of #778.

[bussyjd]

Proactive bug-finding harness — how we find operator-sequence bugs before operators do

Follow-up to the Canary402 field report. Every one of those 10 bugs was found by an operator doing a reasonable-but-unanticipated sequence on a live deployment — none were happy-path failures — which is why example-based unit tests missed them and a human found them first.

This PR documents the one approach that finds that class automatically (a synthetic operator driving generated sequences, checked against invariants rather than hand-written expectations) as four layers, and adds two runnable artifacts:

• docs/testing/proactive-bug-finding.md — the six invariants, the four layers (invariant oracles → stateful model tests → nightly canary cluster → agent audit), how to run each, and why it beats more unit tests.
• .claude/workflows/obol-audit.js — the reusable layer-4 workflow: N hostile-operator lenses fan out, each candidate is checked by two independent adversarial refuters, output is the ranked confirmed survivors. Re-run with Workflow({ name: "obol-audit", args: { known: [...already-fixed...] } }).
• hack/canary/run-canary.sh — the layer-3 ephemeral-k3s scenario-matrix skeleton (real CLI + black-box invariant probes; fail-loud for nightly CI). Cluster bring-up and the on-chain scenarios are marked TODO for your environment.

First run — 2026-07-16 (recorded in the doc)

Layer 4 was run against integration with all six field-report fixes merged, so it hunted for new bugs. 8 lenses × 2 refuters → 11 confirmed (3 rejected by a refuter, correctly). The layer-1 name-injectivity oracle independently found the same #1 grant-collision bug the agent sweep did — two methods, one bug.

Two of the eleven are already handled: the critical unvalidated-price bug (separate PR) and the ReferenceGrant dash-collision (folded into #767). The doc's triage table lists the remaining nine confirmed findings (four of them the same status-truth invariant broken in new places) as an actionable worklist.

Docs + tooling only — no production code changes.

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

[bussyjd]

Superseded by #778, which removes these internal tooling/docs from the production repo entirely (they don't belong in the shipped product, and the findings tables risked disclosing open issues on public main). The one durable artifact — the name_injectivity_test.go regression test — is retained via #767. Closing in favor of #778.

[bussyjd]

Proactive bug-finding harness — how we find operator-sequence bugs before operators do

Follow-up to the Canary402 field report. Every one of those 10 bugs was found by an operator doing a reasonable-but-unanticipated sequence on a live deployment — none were happy-path failures — which is why example-based unit tests missed them and a human found them first.

This PR documents the one approach that finds that class automatically (a synthetic operator driving generated sequences, checked against invariants rather than hand-written expectations) as four layers, and adds two runnable artifacts:

• docs/testing/proactive-bug-finding.md — the six invariants, the four layers (invariant oracles → stateful model tests → nightly canary cluster → agent audit), how to run each, and why it beats more unit tests.
• .claude/workflows/obol-audit.js — the reusable layer-4 workflow: N hostile-operator lenses fan out, each candidate is checked by two independent adversarial refuters, output is the ranked confirmed survivors. Re-run with Workflow({ name: "obol-audit", args: { known: [...already-fixed...] } }).
• hack/canary/run-canary.sh — the layer-3 ephemeral-k3s scenario-matrix skeleton (real CLI + black-box invariant probes; fail-loud for nightly CI). Cluster bring-up and the on-chain scenarios are marked TODO for your environment.

First run — 2026-07-16 (recorded in the doc)

Layer 4 was run against integration with all six field-report fixes merged, so it hunted for new bugs. 8 lenses × 2 refuters → 11 confirmed (3 rejected by a refuter, correctly). The layer-1 name-injectivity oracle independently found the same #1 grant-collision bug the agent sweep did — two methods, one bug.

Two of the eleven are already handled: the critical unvalidated-price bug (separate PR) and the ReferenceGrant dash-collision (folded into #767). The doc's triage table lists the remaining nine confirmed findings (four of them the same status-truth invariant broken in new places) as an actionable worklist.

Docs + tooling only — no production code changes.

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

[bussyjd]

Superseded by #778, which removes these internal tooling/docs from the production repo entirely (they don't belong in the shipped product, and the findings tables risked disclosing open issues on public main). The one durable artifact — the name_injectivity_test.go regression test — is retained via #767. Closing in favor of #778.

[bussyjd]

Proactive bug-finding harness — how we find operator-sequence bugs before operators do

Follow-up to the Canary402 field report. Every one of those 10 bugs was found by an operator doing a reasonable-but-unanticipated sequence on a live deployment — none were happy-path failures — which is why example-based unit tests missed them and a human found them first.

This PR documents the one approach that finds that class automatically (a synthetic operator driving generated sequences, checked against invariants rather than hand-written expectations) as four layers, and adds two runnable artifacts:

• docs/testing/proactive-bug-finding.md — the six invariants, the four layers (invariant oracles → stateful model tests → nightly canary cluster → agent audit), how to run each, and why it beats more unit tests.
• .claude/workflows/obol-audit.js — the reusable layer-4 workflow: N hostile-operator lenses fan out, each candidate is checked by two independent adversarial refuters, output is the ranked confirmed survivors. Re-run with Workflow({ name: "obol-audit", args: { known: [...already-fixed...] } }).
• hack/canary/run-canary.sh — the layer-3 ephemeral-k3s scenario-matrix skeleton (real CLI + black-box invariant probes; fail-loud for nightly CI). Cluster bring-up and the on-chain scenarios are marked TODO for your environment.

First run — 2026-07-16 (recorded in the doc)

Layer 4 was run against integration with all six field-report fixes merged, so it hunted for new bugs. 8 lenses × 2 refuters → 11 confirmed (3 rejected by a refuter, correctly). The layer-1 name-injectivity oracle independently found the same #1 grant-collision bug the agent sweep did — two methods, one bug.

Two of the eleven are already handled: the critical unvalidated-price bug (separate PR) and the ReferenceGrant dash-collision (folded into #767). The doc's triage table lists the remaining nine confirmed findings (four of them the same status-truth invariant broken in new places) as an actionable worklist.

Docs + tooling only — no production code changes.

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

[bussyjd]

Superseded by #778, which removes these internal tooling/docs from the production repo entirely (they don't belong in the shipped product, and the findings tables risked disclosing open issues on public main). The one durable artifact — the name_injectivity_test.go regression test — is retained via #767. Closing in favor of #778.

[bussyjd]

Proactive bug-finding harness — how we find operator-sequence bugs before operators do

Follow-up to the Canary402 field report. Every one of those 10 bugs was found by an operator doing a reasonable-but-unanticipated sequence on a live deployment — none were happy-path failures — which is why example-based unit tests missed them and a human found them first.

This PR documents the one approach that finds that class automatically (a synthetic operator driving generated sequences, checked against invariants rather than hand-written expectations) as four layers, and adds two runnable artifacts:

• docs/testing/proactive-bug-finding.md — the six invariants, the four layers (invariant oracles → stateful model tests → nightly canary cluster → agent audit), how to run each, and why it beats more unit tests.
• .claude/workflows/obol-audit.js — the reusable layer-4 workflow: N hostile-operator lenses fan out, each candidate is checked by two independent adversarial refuters, output is the ranked confirmed survivors. Re-run with Workflow({ name: "obol-audit", args: { known: [...already-fixed...] } }).
• hack/canary/run-canary.sh — the layer-3 ephemeral-k3s scenario-matrix skeleton (real CLI + black-box invariant probes; fail-loud for nightly CI). Cluster bring-up and the on-chain scenarios are marked TODO for your environment.

First run — 2026-07-16 (recorded in the doc)

Layer 4 was run against integration with all six field-report fixes merged, so it hunted for new bugs. 8 lenses × 2 refuters → 11 confirmed (3 rejected by a refuter, correctly). The layer-1 name-injectivity oracle independently found the same #1 grant-collision bug the agent sweep did — two methods, one bug.

Two of the eleven are already handled: the critical unvalidated-price bug (separate PR) and the ReferenceGrant dash-collision (folded into #767). The doc's triage table lists the remaining nine confirmed findings (four of them the same status-truth invariant broken in new places) as an actionable worklist.

Docs + tooling only — no production code changes.

https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk

[bussyjd]

Superseded by #778, which removes these internal tooling/docs from the production repo entirely (they don't belong in the shipped product, and the findings tables risked disclosing open issues on public main). The one durable artifact — the name_injectivity_test.go regression test — is retained via #767. Closing in favor of #778.