knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179

Open
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728
Open

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges)#179
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728

Conversation

@choiyounggi

Copy link
Copy Markdown
Owner

Knowledge flush — 12 insight(s)

Batch: 12 of 109 pending candidates were claimed (queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).

Verified best-practice

#Candidate (hash)ClaimSources checked (fetched/read)How verifiedConfidence
12002a817b2e74f84A quantifier after a non-ASCII literal binds to the last UTF-8 byte under LC_ALL=C; group it (─){3,} and test under CPOSIX grep spec (already cited on the page); bug-grep list thread on unibyte vs multibyte code pathsReproduced on macOS BSD grep 2.6.0-FreeBSD and BSD sed: ─{3,} → 0 under C, 1 under UTF-8; (─){3,} → 1 in both; a + two bare 0x80 bytes matches ─{3,} under C (last-byte binding). GNU grep not installed → GNU result stated as untestedverified (BSD); GNU untested, said so on the page
26b8811c6c3b0f983permissions.deny is enforced in bypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedhttps://code.claude.com/docs/en/permission-modes ("Deny rules block in every mode, including bypassPermissions … Allow rules have no effect in bypassPermissions"); https://code.claude.com/docs/en/permissions (deny-at-any-level, separator list, stripped-wrapper list)Direct quotes. Correction: the candidate listed env among stripped wrappers; the docs' list is timeout, time, nice, nohup, stdbuf, command, builtin, noglob plus a leading VAR=valueenv is not stripped. Page says soverified
3a9ebd8fda72aade6Slow Kotlin build + Exception during IR lowering → suspect heap; raise Gradle + Kotlin daemon heap at user levelhttps://docs.gradle.org/current/userguide/build_environment.html (user-level precedence quote); https://kotlinlang.org/docs/gradle-compilation-and-caches.html (kotlin.daemon.jvmargs vs -Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits -Xmx)Docs fetched and the property keys re-grepped from the raw HTML by me. Correction: the candidate's kotlin.daemon.jvm.options=-Xmx4g line is a system property valid only inside org.gradle.jvmargs; the Gradle key is kotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)field-tested; page keeps the compiler-defect hypothesis explicit
444cd212b53946b62Bash-hook guard misses Write/Edit escapes; on escalation check main git status, transfer by patch (diffapply --check/applycheckout --)https://code.claude.com/docs/en/hooks (matcher Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--check quote)Mechanics doc-confirmed; the recovery recipe is the session's field reproduction (lo-2 files transferred, main restored, MAIN_CLEAN). Merged into a page already verifiedverified page, field-tested addition
52e3d108012a7e164Unbound method extraction loses this; bind at extraction; a vi.fn() test cannot catch ithttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this; https://vitest.dev/api/mock.htmlnode -e repro: unbound → TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest's mock.contexts records this per call, so a vi.fn() test can catch it when it asserts mock.contexts[0] === obj; page offers that as the third test shapeverified
628897d4a24a46ae9Parallel branches green alone can fail on merge (E0004); build+test the merged tree before dispatching dependentshttps://martinfowler.com/bliki/SemanticConflict.html; https://git-scm.com/docs/git-merge; https://doc.rust-lang.org/error_codes/E0004.htmlQuotes: "safely merged on a textual level but cause the program to behave differently"; git merge documented as textual 3-way only; E0004 non-exhaustive patterns. Field run slk1 as the reproductionverified
7f978fd126f72956fWrite the interpreter by path in worker briefs; measure and record the baseline Ran N / failures=M firsthttps://docs.python.org/3/library/venv.html ("You don't specifically need to activate…"); https://docs.python.org/3/library/unittest.htmlDocs quoted; Ran 3 tests … FAILED (failures=1, errors=1) reproduced locally; field measurement 3532/15+18 vs 3549/1verified (baseline-recording half is process advice grounded in completion-claims)
8076309143096ed63A substring doc-coverage gate is vacuous; scope to heading lines with word boundaries; falsify against a known-bad revisionhttps://testing.googleblog.com/2020/08/code-coverage-best-practices.html ("Mutation testing can help detect such false coverage"); the page's existing mutation-testing and RuleTester sourcesSource fetched; field reproduction (commit 7bdbb1c: pre-fix doc → missing: ['grammar'])verified sources, merged into a field-tested page
95d4a63ae21e06d9eAfter an auditor reports mutation testing on your uncommitted tree, diff against a pre-audit patch and re-run the suite yourselfhttps://git-scm.com/docs/git-checkout (checkout -- <path> discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's own agents/test-quality-auditor.md (restore mechanism)Docs quoted; repo file read; wiki's own caveat (untracked file diffs clean either way) supports the independent check. The "session must verify independently" step is the session's practice, not an external normfield-tested
10d3d8fdcc202b8760tmux ls sees one server only; before resuming as coordinator, prove no live coordinator via ps + artifact mtimesman tmux (list-sessions scoped to a server; -L/-S); man ps (-A, -o lstart,command); repo skills/orchestrate/SKILL.md re-entry sectionMan pages read; nuance added: a missing watcher process alone proves nothing (coordinator between polls), only presence proves liveness — page states both-absences rule. Field run: PID 54780 alive on ssh pty, duplicate commits on t3field-tested (man-page facts verified)
1187d2a59d6b82953cargparse required=True accepts ""; realpath("") is the CWD; reject empty before resolvinghttps://docs.python.org/3/library/argparse.html#required; https://docs.python.org/3/library/os.path.html#os.path.abspathQuotes; local repro parse_args(["--out",""])Namespace(out=''), realpath('') → cwdverified
12f301809d865f8865Guard bats suite inside a worker floods the run's escalation dir and reads the worktree's sandbox config via upward traversal; override the env + run from a clean cwdhttps://bats-core.readthedocs.io/en/stable/writing-tests.html (bats-run-* naming); repo skills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard source groundwork/plugins/guardrails/hooks/bash-guard.sh + its bats tests (the two named tests do not cd into their tmpdir)Mechanism confirmed by reading the real scripts; the 175-record count is the session's observationfield-tested

Existing-layer check

Routing went through INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.

Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite

Per candidate:

#Overlap foundDecision
1unicode-text-matching already has a generic "quantifier over non-ASCII → test on both userlands" rowMerged into it: +1 edge row (last-byte binding under C, grouping fix), +1 Instead-of row, +2 sources; related +bsd-vs-gnu-cli both ways
2agent-permission-classifier-denials has the deny tier in its precedence table but is scoped to auto-mode classifier denials; worktree-isolated-workers covers path isolation, not command classesNew pageplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-pass
3threads-and-memory covers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsNew pagebackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testing
4worktree-isolated-workers already carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowMerged: +1 edge row (escalation-time main-tree check + patch transfer, complete hook matcher), +1 Instead-of row, +git-apply source, +field reproduction. No conflict with the existing directive — it extends it
5what-to-mock and tests-that-cannot-fail cover mock-hides-bug generally; nothing on this bindingNew pagetesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choice
6shared-run-state (default branch moved), cross-module-consumer-census (integration-time census), widening-a-closed-value-table (enum/table widening) are adjacent; none covers the post-merge build gateNew pageinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claims
7path-resolution (pin binaries in automation), version-management (shims absent non-interactively), completion-claims (dropped total = red) each hold one thirdNew pageinfrastructure/agent-orchestration/verify-command-in-a-worker-brief composing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workers
8spec-document-gates axis table ("token survives in a nearby paragraph"), spec-artifact-checks (negative control per check), checks-that-cannot-pass (known-good/known-bad) already own the principleMerged into spec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additions
9tests-that-cannot-fail (restore mechanism by commit state; multi-agent shared tree), mutation-harness-file-custody (untracked file diffs clean either way), completion-claims (relaying subagent reports)Merged into completion-claims claim/evidence table (+1 row, +git-checkout source, +field reproduction); related +mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)
10shared-run-state step 3 confirms a foreign run from the repo; autonomous-decision-rulings step 3 re-reads the ledger on resumeMerged into shared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope, ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproduction
11path-valued-config already rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputsMerged: When-this-applies widened to required CLI flags, "" added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sources
12test-data-and-isolation already has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)Merged (delta only): +1 edge row (cwd-walking config discovery + override the exported escalation dir), +bats source, +field reproduction; coordinator-side cleanup row added to shared-run-state

Conflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.

Open-PR check

gh pr list --repo choiyounggi/dev-loop --state open --json number,headRefName,title --search "head:knowledge/"

returned no rows, and gh pr list --state open --limit 50 (any head) also returned no rows at flush time (2026-09-03 17:28 KST, as choiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.

Per-candidate verdict: all 12 → new (no overlapping open head).

Routing decision

#TargetCategory fit
1platforms/environment/unicode-text-matching (merge)existing
2platforms/tools/deny-rules-under-bypassed-permissions (new page)tools already holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new category
3backend/java/kotlin/compiler-daemon-heap-pressure (new page)kotlin is the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new category
4infrastructure/agent-orchestration/worktree-isolated-workers (merge)existing
5testing/mocking/extracted-method-this-binding (new page)the changed artifact is the test's mock choice → mocking; frontend has no language-mechanics category and the lesson is not React-specific
6infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (new page)the coordinator's integration step owns the merged tree → agent-orchestration
7infrastructure/agent-orchestration/verify-command-in-a-worker-brief (new page)brief authoring is agent-orchestration (same category as worktree-isolated-workers' brief rules)
8qa/document-verification/spec-document-gates (merge)existing
9qa/process/completion-claims (merge)existing
10infrastructure/agent-orchestration/shared-run-state (merge)existing
11infrastructure/config/path-valued-config (merge)existing
12testing/data/test-data-and-isolation (merge) + shared-run-state (coordinator side)existing

No new category was needed. Indexes updated: wiki/platforms/index.md, wiki/infrastructure/index.md, wiki/backend/java/index.md, wiki/testing/index.md, wiki/qa/index.md, root INDEX.md (infrastructure and platforms route lines); log.md appended.

Checks run before the PR: node scripts/wiki-lint-prohibitions.js wiki, node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over every related: id, inline [id] reference, and page-to-index listing (results in the PR conversation).

5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated.
New: platforms/tools/deny-rules-under-bypassed-permissions,
infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge,
infrastructure/agent-orchestration/verify-command-in-a-worker-brief,
backend/java/kotlin/compiler-daemon-heap-pressure,
testing/mocking/extracted-method-this-binding.
Amended: unicode-text-matching, worktree-isolated-workers,
spec-document-gates, path-valued-config, completion-claims,
shared-run-state, test-data-and-isolation.
See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
…kers (pre-write escape deny + --git-common-dir mechanism)
@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: worktree-isolated-workers gains Do-this step 7 (state dirs named worktree-relative; --git-common-dir vs --show-toplevel mechanism), a pre-write worktree_escape deny + relative-path edge-case row, an Instead-of row, and two source lines. Disjoint from this PR's post-hoc patch-transfer row. Lint: 0 violations, 0 structure findings.

@github-actions

Copy link
Copy Markdown

Wiki agent gate: fail

PR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via related:, so neither triggers the advisory rule. Fact check: 18 of 19 newly-cited external quotes were WebFetched and confirmed accurate (I independently re-fetched the 19th myself to verify). One blocker: a source citation on wiki/qa/document-verification/spec-document-gates.md attributes a sentence to the Google Testing Blog article body when it is actually a reader's comment on that page, not the article's own content.

  • blocker [fact] wiki/qa/document-verification/spec-document-gates.md — The Sources entry "https://testing.googleblog.com/2020/08/code-coverage-best-practices.html — ... 'Mutation testing can help detect such false coverage' — the same presence-versus-verification gap a substring gate has" cites that sentence as if it were the article's own content. I fetched the page directly: the sentence is not in the Google-authored article body — it appears only in a reader comment posted by a commenter ("Дмитрий", Oct 2020) responding to another reader. Citing a blog comment as if it were the article misrepresents the source's authority for a claim this page uses to justify adding mutation testing as a coverage-gate remedy. Fix: either drop the citation and rely on the page's own field reproduction (commit 7bdbb1c) plus the already-cited https://testing.googleblog.com/2021/04/mutation-testing.html source (already in this page's frontmatter sources: list and directly on-topic), or explicitly attribute the quote as a reader comment rather than the article.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Fold from the 2026-09-03 20:38 flush (queue hash 3e979f78): pushed 84eefc9 — extends the worktree_escape recovery row in worktree-isolated-workers with "stop the escaping worker before lifting the patch" and mtime-based attribution when several workers are in flight, adds an edge-case row for the symptom "an unrelated test fails right after a merge / the integration branch in main is dirty" (escaped edits ride into the next merge commit as another task's work), plus the linkly t112 field evidence (11 misattributed failures cleared). Candidate retired as folded; no sibling PR opened.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:

  • verify-command-in-a-worker-brief: edge-case + instead-of rows — a task whose deliverable is a numbered/spec document in a repo with README-count / generated-reference currency gates names those gate tests on its own verify line (field evidence: linkly run enf0829, 10 integration failures from one missing RFC_ROUTES["0043"] entry).
  • worktree-isolated-workers: instead-of row — when the Bash-only guard matcher cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (field evidence: linkly 2026-08-26, three Edit-tool writes passed silently while a Bash diff tripped the guard).

Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev-loop:knowledgeAuto-opened wiki knowledge ingest PR (owner reviews & merges)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@choiyounggi
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179

Open
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728
Open

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges)#179
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728

Conversation

@choiyounggi

Copy link
Copy Markdown
Owner

Knowledge flush — 12 insight(s)

Batch: 12 of 109 pending candidates were claimed (queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).

Verified best-practice

#Candidate (hash)ClaimSources checked (fetched/read)How verifiedConfidence
12002a817b2e74f84A quantifier after a non-ASCII literal binds to the last UTF-8 byte under LC_ALL=C; group it (─){3,} and test under CPOSIX grep spec (already cited on the page); bug-grep list thread on unibyte vs multibyte code pathsReproduced on macOS BSD grep 2.6.0-FreeBSD and BSD sed: ─{3,} → 0 under C, 1 under UTF-8; (─){3,} → 1 in both; a + two bare 0x80 bytes matches ─{3,} under C (last-byte binding). GNU grep not installed → GNU result stated as untestedverified (BSD); GNU untested, said so on the page
26b8811c6c3b0f983permissions.deny is enforced in bypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedhttps://code.claude.com/docs/en/permission-modes ("Deny rules block in every mode, including bypassPermissions … Allow rules have no effect in bypassPermissions"); https://code.claude.com/docs/en/permissions (deny-at-any-level, separator list, stripped-wrapper list)Direct quotes. Correction: the candidate listed env among stripped wrappers; the docs' list is timeout, time, nice, nohup, stdbuf, command, builtin, noglob plus a leading VAR=valueenv is not stripped. Page says soverified
3a9ebd8fda72aade6Slow Kotlin build + Exception during IR lowering → suspect heap; raise Gradle + Kotlin daemon heap at user levelhttps://docs.gradle.org/current/userguide/build_environment.html (user-level precedence quote); https://kotlinlang.org/docs/gradle-compilation-and-caches.html (kotlin.daemon.jvmargs vs -Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits -Xmx)Docs fetched and the property keys re-grepped from the raw HTML by me. Correction: the candidate's kotlin.daemon.jvm.options=-Xmx4g line is a system property valid only inside org.gradle.jvmargs; the Gradle key is kotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)field-tested; page keeps the compiler-defect hypothesis explicit
444cd212b53946b62Bash-hook guard misses Write/Edit escapes; on escalation check main git status, transfer by patch (diffapply --check/applycheckout --)https://code.claude.com/docs/en/hooks (matcher Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--check quote)Mechanics doc-confirmed; the recovery recipe is the session's field reproduction (lo-2 files transferred, main restored, MAIN_CLEAN). Merged into a page already verifiedverified page, field-tested addition
52e3d108012a7e164Unbound method extraction loses this; bind at extraction; a vi.fn() test cannot catch ithttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this; https://vitest.dev/api/mock.htmlnode -e repro: unbound → TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest's mock.contexts records this per call, so a vi.fn() test can catch it when it asserts mock.contexts[0] === obj; page offers that as the third test shapeverified
628897d4a24a46ae9Parallel branches green alone can fail on merge (E0004); build+test the merged tree before dispatching dependentshttps://martinfowler.com/bliki/SemanticConflict.html; https://git-scm.com/docs/git-merge; https://doc.rust-lang.org/error_codes/E0004.htmlQuotes: "safely merged on a textual level but cause the program to behave differently"; git merge documented as textual 3-way only; E0004 non-exhaustive patterns. Field run slk1 as the reproductionverified
7f978fd126f72956fWrite the interpreter by path in worker briefs; measure and record the baseline Ran N / failures=M firsthttps://docs.python.org/3/library/venv.html ("You don't specifically need to activate…"); https://docs.python.org/3/library/unittest.htmlDocs quoted; Ran 3 tests … FAILED (failures=1, errors=1) reproduced locally; field measurement 3532/15+18 vs 3549/1verified (baseline-recording half is process advice grounded in completion-claims)
8076309143096ed63A substring doc-coverage gate is vacuous; scope to heading lines with word boundaries; falsify against a known-bad revisionhttps://testing.googleblog.com/2020/08/code-coverage-best-practices.html ("Mutation testing can help detect such false coverage"); the page's existing mutation-testing and RuleTester sourcesSource fetched; field reproduction (commit 7bdbb1c: pre-fix doc → missing: ['grammar'])verified sources, merged into a field-tested page
95d4a63ae21e06d9eAfter an auditor reports mutation testing on your uncommitted tree, diff against a pre-audit patch and re-run the suite yourselfhttps://git-scm.com/docs/git-checkout (checkout -- <path> discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's own agents/test-quality-auditor.md (restore mechanism)Docs quoted; repo file read; wiki's own caveat (untracked file diffs clean either way) supports the independent check. The "session must verify independently" step is the session's practice, not an external normfield-tested
10d3d8fdcc202b8760tmux ls sees one server only; before resuming as coordinator, prove no live coordinator via ps + artifact mtimesman tmux (list-sessions scoped to a server; -L/-S); man ps (-A, -o lstart,command); repo skills/orchestrate/SKILL.md re-entry sectionMan pages read; nuance added: a missing watcher process alone proves nothing (coordinator between polls), only presence proves liveness — page states both-absences rule. Field run: PID 54780 alive on ssh pty, duplicate commits on t3field-tested (man-page facts verified)
1187d2a59d6b82953cargparse required=True accepts ""; realpath("") is the CWD; reject empty before resolvinghttps://docs.python.org/3/library/argparse.html#required; https://docs.python.org/3/library/os.path.html#os.path.abspathQuotes; local repro parse_args(["--out",""])Namespace(out=''), realpath('') → cwdverified
12f301809d865f8865Guard bats suite inside a worker floods the run's escalation dir and reads the worktree's sandbox config via upward traversal; override the env + run from a clean cwdhttps://bats-core.readthedocs.io/en/stable/writing-tests.html (bats-run-* naming); repo skills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard source groundwork/plugins/guardrails/hooks/bash-guard.sh + its bats tests (the two named tests do not cd into their tmpdir)Mechanism confirmed by reading the real scripts; the 175-record count is the session's observationfield-tested

Existing-layer check

Routing went through INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.

Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite

Per candidate:

#Overlap foundDecision
1unicode-text-matching already has a generic "quantifier over non-ASCII → test on both userlands" rowMerged into it: +1 edge row (last-byte binding under C, grouping fix), +1 Instead-of row, +2 sources; related +bsd-vs-gnu-cli both ways
2agent-permission-classifier-denials has the deny tier in its precedence table but is scoped to auto-mode classifier denials; worktree-isolated-workers covers path isolation, not command classesNew pageplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-pass
3threads-and-memory covers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsNew pagebackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testing
4worktree-isolated-workers already carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowMerged: +1 edge row (escalation-time main-tree check + patch transfer, complete hook matcher), +1 Instead-of row, +git-apply source, +field reproduction. No conflict with the existing directive — it extends it
5what-to-mock and tests-that-cannot-fail cover mock-hides-bug generally; nothing on this bindingNew pagetesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choice
6shared-run-state (default branch moved), cross-module-consumer-census (integration-time census), widening-a-closed-value-table (enum/table widening) are adjacent; none covers the post-merge build gateNew pageinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claims
7path-resolution (pin binaries in automation), version-management (shims absent non-interactively), completion-claims (dropped total = red) each hold one thirdNew pageinfrastructure/agent-orchestration/verify-command-in-a-worker-brief composing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workers
8spec-document-gates axis table ("token survives in a nearby paragraph"), spec-artifact-checks (negative control per check), checks-that-cannot-pass (known-good/known-bad) already own the principleMerged into spec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additions
9tests-that-cannot-fail (restore mechanism by commit state; multi-agent shared tree), mutation-harness-file-custody (untracked file diffs clean either way), completion-claims (relaying subagent reports)Merged into completion-claims claim/evidence table (+1 row, +git-checkout source, +field reproduction); related +mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)
10shared-run-state step 3 confirms a foreign run from the repo; autonomous-decision-rulings step 3 re-reads the ledger on resumeMerged into shared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope, ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproduction
11path-valued-config already rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputsMerged: When-this-applies widened to required CLI flags, "" added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sources
12test-data-and-isolation already has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)Merged (delta only): +1 edge row (cwd-walking config discovery + override the exported escalation dir), +bats source, +field reproduction; coordinator-side cleanup row added to shared-run-state

Conflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.

Open-PR check

gh pr list --repo choiyounggi/dev-loop --state open --json number,headRefName,title --search "head:knowledge/"

returned no rows, and gh pr list --state open --limit 50 (any head) also returned no rows at flush time (2026-09-03 17:28 KST, as choiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.

Per-candidate verdict: all 12 → new (no overlapping open head).

Routing decision

#TargetCategory fit
1platforms/environment/unicode-text-matching (merge)existing
2platforms/tools/deny-rules-under-bypassed-permissions (new page)tools already holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new category
3backend/java/kotlin/compiler-daemon-heap-pressure (new page)kotlin is the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new category
4infrastructure/agent-orchestration/worktree-isolated-workers (merge)existing
5testing/mocking/extracted-method-this-binding (new page)the changed artifact is the test's mock choice → mocking; frontend has no language-mechanics category and the lesson is not React-specific
6infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (new page)the coordinator's integration step owns the merged tree → agent-orchestration
7infrastructure/agent-orchestration/verify-command-in-a-worker-brief (new page)brief authoring is agent-orchestration (same category as worktree-isolated-workers' brief rules)
8qa/document-verification/spec-document-gates (merge)existing
9qa/process/completion-claims (merge)existing
10infrastructure/agent-orchestration/shared-run-state (merge)existing
11infrastructure/config/path-valued-config (merge)existing
12testing/data/test-data-and-isolation (merge) + shared-run-state (coordinator side)existing

No new category was needed. Indexes updated: wiki/platforms/index.md, wiki/infrastructure/index.md, wiki/backend/java/index.md, wiki/testing/index.md, wiki/qa/index.md, root INDEX.md (infrastructure and platforms route lines); log.md appended.

Checks run before the PR: node scripts/wiki-lint-prohibitions.js wiki, node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over every related: id, inline [id] reference, and page-to-index listing (results in the PR conversation).

5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated.
New: platforms/tools/deny-rules-under-bypassed-permissions,
infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge,
infrastructure/agent-orchestration/verify-command-in-a-worker-brief,
backend/java/kotlin/compiler-daemon-heap-pressure,
testing/mocking/extracted-method-this-binding.
Amended: unicode-text-matching, worktree-isolated-workers,
spec-document-gates, path-valued-config, completion-claims,
shared-run-state, test-data-and-isolation.
See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
…kers (pre-write escape deny + --git-common-dir mechanism)
@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: worktree-isolated-workers gains Do-this step 7 (state dirs named worktree-relative; --git-common-dir vs --show-toplevel mechanism), a pre-write worktree_escape deny + relative-path edge-case row, an Instead-of row, and two source lines. Disjoint from this PR's post-hoc patch-transfer row. Lint: 0 violations, 0 structure findings.

@github-actions

Copy link
Copy Markdown

Wiki agent gate: fail

PR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via related:, so neither triggers the advisory rule. Fact check: 18 of 19 newly-cited external quotes were WebFetched and confirmed accurate (I independently re-fetched the 19th myself to verify). One blocker: a source citation on wiki/qa/document-verification/spec-document-gates.md attributes a sentence to the Google Testing Blog article body when it is actually a reader's comment on that page, not the article's own content.

  • blocker [fact] wiki/qa/document-verification/spec-document-gates.md — The Sources entry "https://testing.googleblog.com/2020/08/code-coverage-best-practices.html — ... 'Mutation testing can help detect such false coverage' — the same presence-versus-verification gap a substring gate has" cites that sentence as if it were the article's own content. I fetched the page directly: the sentence is not in the Google-authored article body — it appears only in a reader comment posted by a commenter ("Дмитрий", Oct 2020) responding to another reader. Citing a blog comment as if it were the article misrepresents the source's authority for a claim this page uses to justify adding mutation testing as a coverage-gate remedy. Fix: either drop the citation and rely on the page's own field reproduction (commit 7bdbb1c) plus the already-cited https://testing.googleblog.com/2021/04/mutation-testing.html source (already in this page's frontmatter sources: list and directly on-topic), or explicitly attribute the quote as a reader comment rather than the article.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Fold from the 2026-09-03 20:38 flush (queue hash 3e979f78): pushed 84eefc9 — extends the worktree_escape recovery row in worktree-isolated-workers with "stop the escaping worker before lifting the patch" and mtime-based attribution when several workers are in flight, adds an edge-case row for the symptom "an unrelated test fails right after a merge / the integration branch in main is dirty" (escaped edits ride into the next merge commit as another task's work), plus the linkly t112 field evidence (11 misattributed failures cleared). Candidate retired as folded; no sibling PR opened.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:

  • verify-command-in-a-worker-brief: edge-case + instead-of rows — a task whose deliverable is a numbered/spec document in a repo with README-count / generated-reference currency gates names those gate tests on its own verify line (field evidence: linkly run enf0829, 10 integration failures from one missing RFC_ROUTES["0043"] entry).
  • worktree-isolated-workers: instead-of row — when the Bash-only guard matcher cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (field evidence: linkly 2026-08-26, three Edit-tool writes passed silently while a Bash diff tripped the guard).

Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev-loop:knowledgeAuto-opened wiki knowledge ingest PR (owner reviews & merges)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@choiyounggi
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179

Open
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728
Open

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges)#179
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728

Conversation

@choiyounggi

Copy link
Copy Markdown
Owner

Knowledge flush — 12 insight(s)

Batch: 12 of 109 pending candidates were claimed (queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).

Verified best-practice

#Candidate (hash)ClaimSources checked (fetched/read)How verifiedConfidence
12002a817b2e74f84A quantifier after a non-ASCII literal binds to the last UTF-8 byte under LC_ALL=C; group it (─){3,} and test under CPOSIX grep spec (already cited on the page); bug-grep list thread on unibyte vs multibyte code pathsReproduced on macOS BSD grep 2.6.0-FreeBSD and BSD sed: ─{3,} → 0 under C, 1 under UTF-8; (─){3,} → 1 in both; a + two bare 0x80 bytes matches ─{3,} under C (last-byte binding). GNU grep not installed → GNU result stated as untestedverified (BSD); GNU untested, said so on the page
26b8811c6c3b0f983permissions.deny is enforced in bypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedhttps://code.claude.com/docs/en/permission-modes ("Deny rules block in every mode, including bypassPermissions … Allow rules have no effect in bypassPermissions"); https://code.claude.com/docs/en/permissions (deny-at-any-level, separator list, stripped-wrapper list)Direct quotes. Correction: the candidate listed env among stripped wrappers; the docs' list is timeout, time, nice, nohup, stdbuf, command, builtin, noglob plus a leading VAR=valueenv is not stripped. Page says soverified
3a9ebd8fda72aade6Slow Kotlin build + Exception during IR lowering → suspect heap; raise Gradle + Kotlin daemon heap at user levelhttps://docs.gradle.org/current/userguide/build_environment.html (user-level precedence quote); https://kotlinlang.org/docs/gradle-compilation-and-caches.html (kotlin.daemon.jvmargs vs -Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits -Xmx)Docs fetched and the property keys re-grepped from the raw HTML by me. Correction: the candidate's kotlin.daemon.jvm.options=-Xmx4g line is a system property valid only inside org.gradle.jvmargs; the Gradle key is kotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)field-tested; page keeps the compiler-defect hypothesis explicit
444cd212b53946b62Bash-hook guard misses Write/Edit escapes; on escalation check main git status, transfer by patch (diffapply --check/applycheckout --)https://code.claude.com/docs/en/hooks (matcher Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--check quote)Mechanics doc-confirmed; the recovery recipe is the session's field reproduction (lo-2 files transferred, main restored, MAIN_CLEAN). Merged into a page already verifiedverified page, field-tested addition
52e3d108012a7e164Unbound method extraction loses this; bind at extraction; a vi.fn() test cannot catch ithttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this; https://vitest.dev/api/mock.htmlnode -e repro: unbound → TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest's mock.contexts records this per call, so a vi.fn() test can catch it when it asserts mock.contexts[0] === obj; page offers that as the third test shapeverified
628897d4a24a46ae9Parallel branches green alone can fail on merge (E0004); build+test the merged tree before dispatching dependentshttps://martinfowler.com/bliki/SemanticConflict.html; https://git-scm.com/docs/git-merge; https://doc.rust-lang.org/error_codes/E0004.htmlQuotes: "safely merged on a textual level but cause the program to behave differently"; git merge documented as textual 3-way only; E0004 non-exhaustive patterns. Field run slk1 as the reproductionverified
7f978fd126f72956fWrite the interpreter by path in worker briefs; measure and record the baseline Ran N / failures=M firsthttps://docs.python.org/3/library/venv.html ("You don't specifically need to activate…"); https://docs.python.org/3/library/unittest.htmlDocs quoted; Ran 3 tests … FAILED (failures=1, errors=1) reproduced locally; field measurement 3532/15+18 vs 3549/1verified (baseline-recording half is process advice grounded in completion-claims)
8076309143096ed63A substring doc-coverage gate is vacuous; scope to heading lines with word boundaries; falsify against a known-bad revisionhttps://testing.googleblog.com/2020/08/code-coverage-best-practices.html ("Mutation testing can help detect such false coverage"); the page's existing mutation-testing and RuleTester sourcesSource fetched; field reproduction (commit 7bdbb1c: pre-fix doc → missing: ['grammar'])verified sources, merged into a field-tested page
95d4a63ae21e06d9eAfter an auditor reports mutation testing on your uncommitted tree, diff against a pre-audit patch and re-run the suite yourselfhttps://git-scm.com/docs/git-checkout (checkout -- <path> discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's own agents/test-quality-auditor.md (restore mechanism)Docs quoted; repo file read; wiki's own caveat (untracked file diffs clean either way) supports the independent check. The "session must verify independently" step is the session's practice, not an external normfield-tested
10d3d8fdcc202b8760tmux ls sees one server only; before resuming as coordinator, prove no live coordinator via ps + artifact mtimesman tmux (list-sessions scoped to a server; -L/-S); man ps (-A, -o lstart,command); repo skills/orchestrate/SKILL.md re-entry sectionMan pages read; nuance added: a missing watcher process alone proves nothing (coordinator between polls), only presence proves liveness — page states both-absences rule. Field run: PID 54780 alive on ssh pty, duplicate commits on t3field-tested (man-page facts verified)
1187d2a59d6b82953cargparse required=True accepts ""; realpath("") is the CWD; reject empty before resolvinghttps://docs.python.org/3/library/argparse.html#required; https://docs.python.org/3/library/os.path.html#os.path.abspathQuotes; local repro parse_args(["--out",""])Namespace(out=''), realpath('') → cwdverified
12f301809d865f8865Guard bats suite inside a worker floods the run's escalation dir and reads the worktree's sandbox config via upward traversal; override the env + run from a clean cwdhttps://bats-core.readthedocs.io/en/stable/writing-tests.html (bats-run-* naming); repo skills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard source groundwork/plugins/guardrails/hooks/bash-guard.sh + its bats tests (the two named tests do not cd into their tmpdir)Mechanism confirmed by reading the real scripts; the 175-record count is the session's observationfield-tested

Existing-layer check

Routing went through INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.

Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite

Per candidate:

#Overlap foundDecision
1unicode-text-matching already has a generic "quantifier over non-ASCII → test on both userlands" rowMerged into it: +1 edge row (last-byte binding under C, grouping fix), +1 Instead-of row, +2 sources; related +bsd-vs-gnu-cli both ways
2agent-permission-classifier-denials has the deny tier in its precedence table but is scoped to auto-mode classifier denials; worktree-isolated-workers covers path isolation, not command classesNew pageplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-pass
3threads-and-memory covers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsNew pagebackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testing
4worktree-isolated-workers already carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowMerged: +1 edge row (escalation-time main-tree check + patch transfer, complete hook matcher), +1 Instead-of row, +git-apply source, +field reproduction. No conflict with the existing directive — it extends it
5what-to-mock and tests-that-cannot-fail cover mock-hides-bug generally; nothing on this bindingNew pagetesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choice
6shared-run-state (default branch moved), cross-module-consumer-census (integration-time census), widening-a-closed-value-table (enum/table widening) are adjacent; none covers the post-merge build gateNew pageinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claims
7path-resolution (pin binaries in automation), version-management (shims absent non-interactively), completion-claims (dropped total = red) each hold one thirdNew pageinfrastructure/agent-orchestration/verify-command-in-a-worker-brief composing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workers
8spec-document-gates axis table ("token survives in a nearby paragraph"), spec-artifact-checks (negative control per check), checks-that-cannot-pass (known-good/known-bad) already own the principleMerged into spec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additions
9tests-that-cannot-fail (restore mechanism by commit state; multi-agent shared tree), mutation-harness-file-custody (untracked file diffs clean either way), completion-claims (relaying subagent reports)Merged into completion-claims claim/evidence table (+1 row, +git-checkout source, +field reproduction); related +mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)
10shared-run-state step 3 confirms a foreign run from the repo; autonomous-decision-rulings step 3 re-reads the ledger on resumeMerged into shared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope, ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproduction
11path-valued-config already rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputsMerged: When-this-applies widened to required CLI flags, "" added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sources
12test-data-and-isolation already has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)Merged (delta only): +1 edge row (cwd-walking config discovery + override the exported escalation dir), +bats source, +field reproduction; coordinator-side cleanup row added to shared-run-state

Conflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.

Open-PR check

gh pr list --repo choiyounggi/dev-loop --state open --json number,headRefName,title --search "head:knowledge/"

returned no rows, and gh pr list --state open --limit 50 (any head) also returned no rows at flush time (2026-09-03 17:28 KST, as choiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.

Per-candidate verdict: all 12 → new (no overlapping open head).

Routing decision

#TargetCategory fit
1platforms/environment/unicode-text-matching (merge)existing
2platforms/tools/deny-rules-under-bypassed-permissions (new page)tools already holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new category
3backend/java/kotlin/compiler-daemon-heap-pressure (new page)kotlin is the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new category
4infrastructure/agent-orchestration/worktree-isolated-workers (merge)existing
5testing/mocking/extracted-method-this-binding (new page)the changed artifact is the test's mock choice → mocking; frontend has no language-mechanics category and the lesson is not React-specific
6infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (new page)the coordinator's integration step owns the merged tree → agent-orchestration
7infrastructure/agent-orchestration/verify-command-in-a-worker-brief (new page)brief authoring is agent-orchestration (same category as worktree-isolated-workers' brief rules)
8qa/document-verification/spec-document-gates (merge)existing
9qa/process/completion-claims (merge)existing
10infrastructure/agent-orchestration/shared-run-state (merge)existing
11infrastructure/config/path-valued-config (merge)existing
12testing/data/test-data-and-isolation (merge) + shared-run-state (coordinator side)existing

No new category was needed. Indexes updated: wiki/platforms/index.md, wiki/infrastructure/index.md, wiki/backend/java/index.md, wiki/testing/index.md, wiki/qa/index.md, root INDEX.md (infrastructure and platforms route lines); log.md appended.

Checks run before the PR: node scripts/wiki-lint-prohibitions.js wiki, node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over every related: id, inline [id] reference, and page-to-index listing (results in the PR conversation).

5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated.
New: platforms/tools/deny-rules-under-bypassed-permissions,
infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge,
infrastructure/agent-orchestration/verify-command-in-a-worker-brief,
backend/java/kotlin/compiler-daemon-heap-pressure,
testing/mocking/extracted-method-this-binding.
Amended: unicode-text-matching, worktree-isolated-workers,
spec-document-gates, path-valued-config, completion-claims,
shared-run-state, test-data-and-isolation.
See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
…kers (pre-write escape deny + --git-common-dir mechanism)
@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: worktree-isolated-workers gains Do-this step 7 (state dirs named worktree-relative; --git-common-dir vs --show-toplevel mechanism), a pre-write worktree_escape deny + relative-path edge-case row, an Instead-of row, and two source lines. Disjoint from this PR's post-hoc patch-transfer row. Lint: 0 violations, 0 structure findings.

@github-actions

Copy link
Copy Markdown

Wiki agent gate: fail

PR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via related:, so neither triggers the advisory rule. Fact check: 18 of 19 newly-cited external quotes were WebFetched and confirmed accurate (I independently re-fetched the 19th myself to verify). One blocker: a source citation on wiki/qa/document-verification/spec-document-gates.md attributes a sentence to the Google Testing Blog article body when it is actually a reader's comment on that page, not the article's own content.

  • blocker [fact] wiki/qa/document-verification/spec-document-gates.md — The Sources entry "https://testing.googleblog.com/2020/08/code-coverage-best-practices.html — ... 'Mutation testing can help detect such false coverage' — the same presence-versus-verification gap a substring gate has" cites that sentence as if it were the article's own content. I fetched the page directly: the sentence is not in the Google-authored article body — it appears only in a reader comment posted by a commenter ("Дмитрий", Oct 2020) responding to another reader. Citing a blog comment as if it were the article misrepresents the source's authority for a claim this page uses to justify adding mutation testing as a coverage-gate remedy. Fix: either drop the citation and rely on the page's own field reproduction (commit 7bdbb1c) plus the already-cited https://testing.googleblog.com/2021/04/mutation-testing.html source (already in this page's frontmatter sources: list and directly on-topic), or explicitly attribute the quote as a reader comment rather than the article.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Fold from the 2026-09-03 20:38 flush (queue hash 3e979f78): pushed 84eefc9 — extends the worktree_escape recovery row in worktree-isolated-workers with "stop the escaping worker before lifting the patch" and mtime-based attribution when several workers are in flight, adds an edge-case row for the symptom "an unrelated test fails right after a merge / the integration branch in main is dirty" (escaped edits ride into the next merge commit as another task's work), plus the linkly t112 field evidence (11 misattributed failures cleared). Candidate retired as folded; no sibling PR opened.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:

  • verify-command-in-a-worker-brief: edge-case + instead-of rows — a task whose deliverable is a numbered/spec document in a repo with README-count / generated-reference currency gates names those gate tests on its own verify line (field evidence: linkly run enf0829, 10 integration failures from one missing RFC_ROUTES["0043"] entry).
  • worktree-isolated-workers: instead-of row — when the Bash-only guard matcher cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (field evidence: linkly 2026-08-26, three Edit-tool writes passed silently while a Bash diff tripped the guard).

Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev-loop:knowledgeAuto-opened wiki knowledge ingest PR (owner reviews & merges)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@choiyounggi
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179

Open
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728
Open

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges)#179
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728

Conversation

@choiyounggi

Copy link
Copy Markdown
Owner

Knowledge flush — 12 insight(s)

Batch: 12 of 109 pending candidates were claimed (queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).

Verified best-practice

#Candidate (hash)ClaimSources checked (fetched/read)How verifiedConfidence
12002a817b2e74f84A quantifier after a non-ASCII literal binds to the last UTF-8 byte under LC_ALL=C; group it (─){3,} and test under CPOSIX grep spec (already cited on the page); bug-grep list thread on unibyte vs multibyte code pathsReproduced on macOS BSD grep 2.6.0-FreeBSD and BSD sed: ─{3,} → 0 under C, 1 under UTF-8; (─){3,} → 1 in both; a + two bare 0x80 bytes matches ─{3,} under C (last-byte binding). GNU grep not installed → GNU result stated as untestedverified (BSD); GNU untested, said so on the page
26b8811c6c3b0f983permissions.deny is enforced in bypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedhttps://code.claude.com/docs/en/permission-modes ("Deny rules block in every mode, including bypassPermissions … Allow rules have no effect in bypassPermissions"); https://code.claude.com/docs/en/permissions (deny-at-any-level, separator list, stripped-wrapper list)Direct quotes. Correction: the candidate listed env among stripped wrappers; the docs' list is timeout, time, nice, nohup, stdbuf, command, builtin, noglob plus a leading VAR=valueenv is not stripped. Page says soverified
3a9ebd8fda72aade6Slow Kotlin build + Exception during IR lowering → suspect heap; raise Gradle + Kotlin daemon heap at user levelhttps://docs.gradle.org/current/userguide/build_environment.html (user-level precedence quote); https://kotlinlang.org/docs/gradle-compilation-and-caches.html (kotlin.daemon.jvmargs vs -Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits -Xmx)Docs fetched and the property keys re-grepped from the raw HTML by me. Correction: the candidate's kotlin.daemon.jvm.options=-Xmx4g line is a system property valid only inside org.gradle.jvmargs; the Gradle key is kotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)field-tested; page keeps the compiler-defect hypothesis explicit
444cd212b53946b62Bash-hook guard misses Write/Edit escapes; on escalation check main git status, transfer by patch (diffapply --check/applycheckout --)https://code.claude.com/docs/en/hooks (matcher Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--check quote)Mechanics doc-confirmed; the recovery recipe is the session's field reproduction (lo-2 files transferred, main restored, MAIN_CLEAN). Merged into a page already verifiedverified page, field-tested addition
52e3d108012a7e164Unbound method extraction loses this; bind at extraction; a vi.fn() test cannot catch ithttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this; https://vitest.dev/api/mock.htmlnode -e repro: unbound → TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest's mock.contexts records this per call, so a vi.fn() test can catch it when it asserts mock.contexts[0] === obj; page offers that as the third test shapeverified
628897d4a24a46ae9Parallel branches green alone can fail on merge (E0004); build+test the merged tree before dispatching dependentshttps://martinfowler.com/bliki/SemanticConflict.html; https://git-scm.com/docs/git-merge; https://doc.rust-lang.org/error_codes/E0004.htmlQuotes: "safely merged on a textual level but cause the program to behave differently"; git merge documented as textual 3-way only; E0004 non-exhaustive patterns. Field run slk1 as the reproductionverified
7f978fd126f72956fWrite the interpreter by path in worker briefs; measure and record the baseline Ran N / failures=M firsthttps://docs.python.org/3/library/venv.html ("You don't specifically need to activate…"); https://docs.python.org/3/library/unittest.htmlDocs quoted; Ran 3 tests … FAILED (failures=1, errors=1) reproduced locally; field measurement 3532/15+18 vs 3549/1verified (baseline-recording half is process advice grounded in completion-claims)
8076309143096ed63A substring doc-coverage gate is vacuous; scope to heading lines with word boundaries; falsify against a known-bad revisionhttps://testing.googleblog.com/2020/08/code-coverage-best-practices.html ("Mutation testing can help detect such false coverage"); the page's existing mutation-testing and RuleTester sourcesSource fetched; field reproduction (commit 7bdbb1c: pre-fix doc → missing: ['grammar'])verified sources, merged into a field-tested page
95d4a63ae21e06d9eAfter an auditor reports mutation testing on your uncommitted tree, diff against a pre-audit patch and re-run the suite yourselfhttps://git-scm.com/docs/git-checkout (checkout -- <path> discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's own agents/test-quality-auditor.md (restore mechanism)Docs quoted; repo file read; wiki's own caveat (untracked file diffs clean either way) supports the independent check. The "session must verify independently" step is the session's practice, not an external normfield-tested
10d3d8fdcc202b8760tmux ls sees one server only; before resuming as coordinator, prove no live coordinator via ps + artifact mtimesman tmux (list-sessions scoped to a server; -L/-S); man ps (-A, -o lstart,command); repo skills/orchestrate/SKILL.md re-entry sectionMan pages read; nuance added: a missing watcher process alone proves nothing (coordinator between polls), only presence proves liveness — page states both-absences rule. Field run: PID 54780 alive on ssh pty, duplicate commits on t3field-tested (man-page facts verified)
1187d2a59d6b82953cargparse required=True accepts ""; realpath("") is the CWD; reject empty before resolvinghttps://docs.python.org/3/library/argparse.html#required; https://docs.python.org/3/library/os.path.html#os.path.abspathQuotes; local repro parse_args(["--out",""])Namespace(out=''), realpath('') → cwdverified
12f301809d865f8865Guard bats suite inside a worker floods the run's escalation dir and reads the worktree's sandbox config via upward traversal; override the env + run from a clean cwdhttps://bats-core.readthedocs.io/en/stable/writing-tests.html (bats-run-* naming); repo skills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard source groundwork/plugins/guardrails/hooks/bash-guard.sh + its bats tests (the two named tests do not cd into their tmpdir)Mechanism confirmed by reading the real scripts; the 175-record count is the session's observationfield-tested

Existing-layer check

Routing went through INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.

Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite

Per candidate:

#Overlap foundDecision
1unicode-text-matching already has a generic "quantifier over non-ASCII → test on both userlands" rowMerged into it: +1 edge row (last-byte binding under C, grouping fix), +1 Instead-of row, +2 sources; related +bsd-vs-gnu-cli both ways
2agent-permission-classifier-denials has the deny tier in its precedence table but is scoped to auto-mode classifier denials; worktree-isolated-workers covers path isolation, not command classesNew pageplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-pass
3threads-and-memory covers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsNew pagebackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testing
4worktree-isolated-workers already carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowMerged: +1 edge row (escalation-time main-tree check + patch transfer, complete hook matcher), +1 Instead-of row, +git-apply source, +field reproduction. No conflict with the existing directive — it extends it
5what-to-mock and tests-that-cannot-fail cover mock-hides-bug generally; nothing on this bindingNew pagetesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choice
6shared-run-state (default branch moved), cross-module-consumer-census (integration-time census), widening-a-closed-value-table (enum/table widening) are adjacent; none covers the post-merge build gateNew pageinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claims
7path-resolution (pin binaries in automation), version-management (shims absent non-interactively), completion-claims (dropped total = red) each hold one thirdNew pageinfrastructure/agent-orchestration/verify-command-in-a-worker-brief composing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workers
8spec-document-gates axis table ("token survives in a nearby paragraph"), spec-artifact-checks (negative control per check), checks-that-cannot-pass (known-good/known-bad) already own the principleMerged into spec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additions
9tests-that-cannot-fail (restore mechanism by commit state; multi-agent shared tree), mutation-harness-file-custody (untracked file diffs clean either way), completion-claims (relaying subagent reports)Merged into completion-claims claim/evidence table (+1 row, +git-checkout source, +field reproduction); related +mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)
10shared-run-state step 3 confirms a foreign run from the repo; autonomous-decision-rulings step 3 re-reads the ledger on resumeMerged into shared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope, ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproduction
11path-valued-config already rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputsMerged: When-this-applies widened to required CLI flags, "" added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sources
12test-data-and-isolation already has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)Merged (delta only): +1 edge row (cwd-walking config discovery + override the exported escalation dir), +bats source, +field reproduction; coordinator-side cleanup row added to shared-run-state

Conflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.

Open-PR check

gh pr list --repo choiyounggi/dev-loop --state open --json number,headRefName,title --search "head:knowledge/"

returned no rows, and gh pr list --state open --limit 50 (any head) also returned no rows at flush time (2026-09-03 17:28 KST, as choiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.

Per-candidate verdict: all 12 → new (no overlapping open head).

Routing decision

#TargetCategory fit
1platforms/environment/unicode-text-matching (merge)existing
2platforms/tools/deny-rules-under-bypassed-permissions (new page)tools already holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new category
3backend/java/kotlin/compiler-daemon-heap-pressure (new page)kotlin is the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new category
4infrastructure/agent-orchestration/worktree-isolated-workers (merge)existing
5testing/mocking/extracted-method-this-binding (new page)the changed artifact is the test's mock choice → mocking; frontend has no language-mechanics category and the lesson is not React-specific
6infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (new page)the coordinator's integration step owns the merged tree → agent-orchestration
7infrastructure/agent-orchestration/verify-command-in-a-worker-brief (new page)brief authoring is agent-orchestration (same category as worktree-isolated-workers' brief rules)
8qa/document-verification/spec-document-gates (merge)existing
9qa/process/completion-claims (merge)existing
10infrastructure/agent-orchestration/shared-run-state (merge)existing
11infrastructure/config/path-valued-config (merge)existing
12testing/data/test-data-and-isolation (merge) + shared-run-state (coordinator side)existing

No new category was needed. Indexes updated: wiki/platforms/index.md, wiki/infrastructure/index.md, wiki/backend/java/index.md, wiki/testing/index.md, wiki/qa/index.md, root INDEX.md (infrastructure and platforms route lines); log.md appended.

Checks run before the PR: node scripts/wiki-lint-prohibitions.js wiki, node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over every related: id, inline [id] reference, and page-to-index listing (results in the PR conversation).

5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated.
New: platforms/tools/deny-rules-under-bypassed-permissions,
infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge,
infrastructure/agent-orchestration/verify-command-in-a-worker-brief,
backend/java/kotlin/compiler-daemon-heap-pressure,
testing/mocking/extracted-method-this-binding.
Amended: unicode-text-matching, worktree-isolated-workers,
spec-document-gates, path-valued-config, completion-claims,
shared-run-state, test-data-and-isolation.
See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
…kers (pre-write escape deny + --git-common-dir mechanism)
@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: worktree-isolated-workers gains Do-this step 7 (state dirs named worktree-relative; --git-common-dir vs --show-toplevel mechanism), a pre-write worktree_escape deny + relative-path edge-case row, an Instead-of row, and two source lines. Disjoint from this PR's post-hoc patch-transfer row. Lint: 0 violations, 0 structure findings.

@github-actions

Copy link
Copy Markdown

Wiki agent gate: fail

PR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via related:, so neither triggers the advisory rule. Fact check: 18 of 19 newly-cited external quotes were WebFetched and confirmed accurate (I independently re-fetched the 19th myself to verify). One blocker: a source citation on wiki/qa/document-verification/spec-document-gates.md attributes a sentence to the Google Testing Blog article body when it is actually a reader's comment on that page, not the article's own content.

  • blocker [fact] wiki/qa/document-verification/spec-document-gates.md — The Sources entry "https://testing.googleblog.com/2020/08/code-coverage-best-practices.html — ... 'Mutation testing can help detect such false coverage' — the same presence-versus-verification gap a substring gate has" cites that sentence as if it were the article's own content. I fetched the page directly: the sentence is not in the Google-authored article body — it appears only in a reader comment posted by a commenter ("Дмитрий", Oct 2020) responding to another reader. Citing a blog comment as if it were the article misrepresents the source's authority for a claim this page uses to justify adding mutation testing as a coverage-gate remedy. Fix: either drop the citation and rely on the page's own field reproduction (commit 7bdbb1c) plus the already-cited https://testing.googleblog.com/2021/04/mutation-testing.html source (already in this page's frontmatter sources: list and directly on-topic), or explicitly attribute the quote as a reader comment rather than the article.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Fold from the 2026-09-03 20:38 flush (queue hash 3e979f78): pushed 84eefc9 — extends the worktree_escape recovery row in worktree-isolated-workers with "stop the escaping worker before lifting the patch" and mtime-based attribution when several workers are in flight, adds an edge-case row for the symptom "an unrelated test fails right after a merge / the integration branch in main is dirty" (escaped edits ride into the next merge commit as another task's work), plus the linkly t112 field evidence (11 misattributed failures cleared). Candidate retired as folded; no sibling PR opened.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:

  • verify-command-in-a-worker-brief: edge-case + instead-of rows — a task whose deliverable is a numbered/spec document in a repo with README-count / generated-reference currency gates names those gate tests on its own verify line (field evidence: linkly run enf0829, 10 integration failures from one missing RFC_ROUTES["0043"] entry).
  • worktree-isolated-workers: instead-of row — when the Bash-only guard matcher cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (field evidence: linkly 2026-08-26, three Edit-tool writes passed silently while a Bash diff tripped the guard).

Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev-loop:knowledgeAuto-opened wiki knowledge ingest PR (owner reviews & merges)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@choiyounggi
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179

Open
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728
Open

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges)#179
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728

Conversation

@choiyounggi

Copy link
Copy Markdown
Owner

Knowledge flush — 12 insight(s)

Batch: 12 of 109 pending candidates were claimed (queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).

Verified best-practice

#Candidate (hash)ClaimSources checked (fetched/read)How verifiedConfidence
12002a817b2e74f84A quantifier after a non-ASCII literal binds to the last UTF-8 byte under LC_ALL=C; group it (─){3,} and test under CPOSIX grep spec (already cited on the page); bug-grep list thread on unibyte vs multibyte code pathsReproduced on macOS BSD grep 2.6.0-FreeBSD and BSD sed: ─{3,} → 0 under C, 1 under UTF-8; (─){3,} → 1 in both; a + two bare 0x80 bytes matches ─{3,} under C (last-byte binding). GNU grep not installed → GNU result stated as untestedverified (BSD); GNU untested, said so on the page
26b8811c6c3b0f983permissions.deny is enforced in bypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedhttps://code.claude.com/docs/en/permission-modes ("Deny rules block in every mode, including bypassPermissions … Allow rules have no effect in bypassPermissions"); https://code.claude.com/docs/en/permissions (deny-at-any-level, separator list, stripped-wrapper list)Direct quotes. Correction: the candidate listed env among stripped wrappers; the docs' list is timeout, time, nice, nohup, stdbuf, command, builtin, noglob plus a leading VAR=valueenv is not stripped. Page says soverified
3a9ebd8fda72aade6Slow Kotlin build + Exception during IR lowering → suspect heap; raise Gradle + Kotlin daemon heap at user levelhttps://docs.gradle.org/current/userguide/build_environment.html (user-level precedence quote); https://kotlinlang.org/docs/gradle-compilation-and-caches.html (kotlin.daemon.jvmargs vs -Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits -Xmx)Docs fetched and the property keys re-grepped from the raw HTML by me. Correction: the candidate's kotlin.daemon.jvm.options=-Xmx4g line is a system property valid only inside org.gradle.jvmargs; the Gradle key is kotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)field-tested; page keeps the compiler-defect hypothesis explicit
444cd212b53946b62Bash-hook guard misses Write/Edit escapes; on escalation check main git status, transfer by patch (diffapply --check/applycheckout --)https://code.claude.com/docs/en/hooks (matcher Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--check quote)Mechanics doc-confirmed; the recovery recipe is the session's field reproduction (lo-2 files transferred, main restored, MAIN_CLEAN). Merged into a page already verifiedverified page, field-tested addition
52e3d108012a7e164Unbound method extraction loses this; bind at extraction; a vi.fn() test cannot catch ithttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this; https://vitest.dev/api/mock.htmlnode -e repro: unbound → TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest's mock.contexts records this per call, so a vi.fn() test can catch it when it asserts mock.contexts[0] === obj; page offers that as the third test shapeverified
628897d4a24a46ae9Parallel branches green alone can fail on merge (E0004); build+test the merged tree before dispatching dependentshttps://martinfowler.com/bliki/SemanticConflict.html; https://git-scm.com/docs/git-merge; https://doc.rust-lang.org/error_codes/E0004.htmlQuotes: "safely merged on a textual level but cause the program to behave differently"; git merge documented as textual 3-way only; E0004 non-exhaustive patterns. Field run slk1 as the reproductionverified
7f978fd126f72956fWrite the interpreter by path in worker briefs; measure and record the baseline Ran N / failures=M firsthttps://docs.python.org/3/library/venv.html ("You don't specifically need to activate…"); https://docs.python.org/3/library/unittest.htmlDocs quoted; Ran 3 tests … FAILED (failures=1, errors=1) reproduced locally; field measurement 3532/15+18 vs 3549/1verified (baseline-recording half is process advice grounded in completion-claims)
8076309143096ed63A substring doc-coverage gate is vacuous; scope to heading lines with word boundaries; falsify against a known-bad revisionhttps://testing.googleblog.com/2020/08/code-coverage-best-practices.html ("Mutation testing can help detect such false coverage"); the page's existing mutation-testing and RuleTester sourcesSource fetched; field reproduction (commit 7bdbb1c: pre-fix doc → missing: ['grammar'])verified sources, merged into a field-tested page
95d4a63ae21e06d9eAfter an auditor reports mutation testing on your uncommitted tree, diff against a pre-audit patch and re-run the suite yourselfhttps://git-scm.com/docs/git-checkout (checkout -- <path> discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's own agents/test-quality-auditor.md (restore mechanism)Docs quoted; repo file read; wiki's own caveat (untracked file diffs clean either way) supports the independent check. The "session must verify independently" step is the session's practice, not an external normfield-tested
10d3d8fdcc202b8760tmux ls sees one server only; before resuming as coordinator, prove no live coordinator via ps + artifact mtimesman tmux (list-sessions scoped to a server; -L/-S); man ps (-A, -o lstart,command); repo skills/orchestrate/SKILL.md re-entry sectionMan pages read; nuance added: a missing watcher process alone proves nothing (coordinator between polls), only presence proves liveness — page states both-absences rule. Field run: PID 54780 alive on ssh pty, duplicate commits on t3field-tested (man-page facts verified)
1187d2a59d6b82953cargparse required=True accepts ""; realpath("") is the CWD; reject empty before resolvinghttps://docs.python.org/3/library/argparse.html#required; https://docs.python.org/3/library/os.path.html#os.path.abspathQuotes; local repro parse_args(["--out",""])Namespace(out=''), realpath('') → cwdverified
12f301809d865f8865Guard bats suite inside a worker floods the run's escalation dir and reads the worktree's sandbox config via upward traversal; override the env + run from a clean cwdhttps://bats-core.readthedocs.io/en/stable/writing-tests.html (bats-run-* naming); repo skills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard source groundwork/plugins/guardrails/hooks/bash-guard.sh + its bats tests (the two named tests do not cd into their tmpdir)Mechanism confirmed by reading the real scripts; the 175-record count is the session's observationfield-tested

Existing-layer check

Routing went through INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.

Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite

Per candidate:

#Overlap foundDecision
1unicode-text-matching already has a generic "quantifier over non-ASCII → test on both userlands" rowMerged into it: +1 edge row (last-byte binding under C, grouping fix), +1 Instead-of row, +2 sources; related +bsd-vs-gnu-cli both ways
2agent-permission-classifier-denials has the deny tier in its precedence table but is scoped to auto-mode classifier denials; worktree-isolated-workers covers path isolation, not command classesNew pageplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-pass
3threads-and-memory covers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsNew pagebackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testing
4worktree-isolated-workers already carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowMerged: +1 edge row (escalation-time main-tree check + patch transfer, complete hook matcher), +1 Instead-of row, +git-apply source, +field reproduction. No conflict with the existing directive — it extends it
5what-to-mock and tests-that-cannot-fail cover mock-hides-bug generally; nothing on this bindingNew pagetesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choice
6shared-run-state (default branch moved), cross-module-consumer-census (integration-time census), widening-a-closed-value-table (enum/table widening) are adjacent; none covers the post-merge build gateNew pageinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claims
7path-resolution (pin binaries in automation), version-management (shims absent non-interactively), completion-claims (dropped total = red) each hold one thirdNew pageinfrastructure/agent-orchestration/verify-command-in-a-worker-brief composing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workers
8spec-document-gates axis table ("token survives in a nearby paragraph"), spec-artifact-checks (negative control per check), checks-that-cannot-pass (known-good/known-bad) already own the principleMerged into spec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additions
9tests-that-cannot-fail (restore mechanism by commit state; multi-agent shared tree), mutation-harness-file-custody (untracked file diffs clean either way), completion-claims (relaying subagent reports)Merged into completion-claims claim/evidence table (+1 row, +git-checkout source, +field reproduction); related +mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)
10shared-run-state step 3 confirms a foreign run from the repo; autonomous-decision-rulings step 3 re-reads the ledger on resumeMerged into shared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope, ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproduction
11path-valued-config already rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputsMerged: When-this-applies widened to required CLI flags, "" added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sources
12test-data-and-isolation already has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)Merged (delta only): +1 edge row (cwd-walking config discovery + override the exported escalation dir), +bats source, +field reproduction; coordinator-side cleanup row added to shared-run-state

Conflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.

Open-PR check

gh pr list --repo choiyounggi/dev-loop --state open --json number,headRefName,title --search "head:knowledge/"

returned no rows, and gh pr list --state open --limit 50 (any head) also returned no rows at flush time (2026-09-03 17:28 KST, as choiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.

Per-candidate verdict: all 12 → new (no overlapping open head).

Routing decision

#TargetCategory fit
1platforms/environment/unicode-text-matching (merge)existing
2platforms/tools/deny-rules-under-bypassed-permissions (new page)tools already holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new category
3backend/java/kotlin/compiler-daemon-heap-pressure (new page)kotlin is the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new category
4infrastructure/agent-orchestration/worktree-isolated-workers (merge)existing
5testing/mocking/extracted-method-this-binding (new page)the changed artifact is the test's mock choice → mocking; frontend has no language-mechanics category and the lesson is not React-specific
6infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (new page)the coordinator's integration step owns the merged tree → agent-orchestration
7infrastructure/agent-orchestration/verify-command-in-a-worker-brief (new page)brief authoring is agent-orchestration (same category as worktree-isolated-workers' brief rules)
8qa/document-verification/spec-document-gates (merge)existing
9qa/process/completion-claims (merge)existing
10infrastructure/agent-orchestration/shared-run-state (merge)existing
11infrastructure/config/path-valued-config (merge)existing
12testing/data/test-data-and-isolation (merge) + shared-run-state (coordinator side)existing

No new category was needed. Indexes updated: wiki/platforms/index.md, wiki/infrastructure/index.md, wiki/backend/java/index.md, wiki/testing/index.md, wiki/qa/index.md, root INDEX.md (infrastructure and platforms route lines); log.md appended.

Checks run before the PR: node scripts/wiki-lint-prohibitions.js wiki, node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over every related: id, inline [id] reference, and page-to-index listing (results in the PR conversation).

5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated.
New: platforms/tools/deny-rules-under-bypassed-permissions,
infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge,
infrastructure/agent-orchestration/verify-command-in-a-worker-brief,
backend/java/kotlin/compiler-daemon-heap-pressure,
testing/mocking/extracted-method-this-binding.
Amended: unicode-text-matching, worktree-isolated-workers,
spec-document-gates, path-valued-config, completion-claims,
shared-run-state, test-data-and-isolation.
See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
…kers (pre-write escape deny + --git-common-dir mechanism)
@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: worktree-isolated-workers gains Do-this step 7 (state dirs named worktree-relative; --git-common-dir vs --show-toplevel mechanism), a pre-write worktree_escape deny + relative-path edge-case row, an Instead-of row, and two source lines. Disjoint from this PR's post-hoc patch-transfer row. Lint: 0 violations, 0 structure findings.

@github-actions

Copy link
Copy Markdown

Wiki agent gate: fail

PR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via related:, so neither triggers the advisory rule. Fact check: 18 of 19 newly-cited external quotes were WebFetched and confirmed accurate (I independently re-fetched the 19th myself to verify). One blocker: a source citation on wiki/qa/document-verification/spec-document-gates.md attributes a sentence to the Google Testing Blog article body when it is actually a reader's comment on that page, not the article's own content.

  • blocker [fact] wiki/qa/document-verification/spec-document-gates.md — The Sources entry "https://testing.googleblog.com/2020/08/code-coverage-best-practices.html — ... 'Mutation testing can help detect such false coverage' — the same presence-versus-verification gap a substring gate has" cites that sentence as if it were the article's own content. I fetched the page directly: the sentence is not in the Google-authored article body — it appears only in a reader comment posted by a commenter ("Дмитрий", Oct 2020) responding to another reader. Citing a blog comment as if it were the article misrepresents the source's authority for a claim this page uses to justify adding mutation testing as a coverage-gate remedy. Fix: either drop the citation and rely on the page's own field reproduction (commit 7bdbb1c) plus the already-cited https://testing.googleblog.com/2021/04/mutation-testing.html source (already in this page's frontmatter sources: list and directly on-topic), or explicitly attribute the quote as a reader comment rather than the article.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Fold from the 2026-09-03 20:38 flush (queue hash 3e979f78): pushed 84eefc9 — extends the worktree_escape recovery row in worktree-isolated-workers with "stop the escaping worker before lifting the patch" and mtime-based attribution when several workers are in flight, adds an edge-case row for the symptom "an unrelated test fails right after a merge / the integration branch in main is dirty" (escaped edits ride into the next merge commit as another task's work), plus the linkly t112 field evidence (11 misattributed failures cleared). Candidate retired as folded; no sibling PR opened.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:

  • verify-command-in-a-worker-brief: edge-case + instead-of rows — a task whose deliverable is a numbered/spec document in a repo with README-count / generated-reference currency gates names those gate tests on its own verify line (field evidence: linkly run enf0829, 10 integration failures from one missing RFC_ROUTES["0043"] entry).
  • worktree-isolated-workers: instead-of row — when the Bash-only guard matcher cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (field evidence: linkly 2026-08-26, three Edit-tool writes passed silently while a Bash diff tripped the guard).

Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev-loop:knowledgeAuto-opened wiki knowledge ingest PR (owner reviews & merges)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@choiyounggi
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179

Open
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728
Open

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges)#179
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728

Conversation

@choiyounggi

Copy link
Copy Markdown
Owner

Knowledge flush — 12 insight(s)

Batch: 12 of 109 pending candidates were claimed (queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).

Verified best-practice

#Candidate (hash)ClaimSources checked (fetched/read)How verifiedConfidence
12002a817b2e74f84A quantifier after a non-ASCII literal binds to the last UTF-8 byte under LC_ALL=C; group it (─){3,} and test under CPOSIX grep spec (already cited on the page); bug-grep list thread on unibyte vs multibyte code pathsReproduced on macOS BSD grep 2.6.0-FreeBSD and BSD sed: ─{3,} → 0 under C, 1 under UTF-8; (─){3,} → 1 in both; a + two bare 0x80 bytes matches ─{3,} under C (last-byte binding). GNU grep not installed → GNU result stated as untestedverified (BSD); GNU untested, said so on the page
26b8811c6c3b0f983permissions.deny is enforced in bypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedhttps://code.claude.com/docs/en/permission-modes ("Deny rules block in every mode, including bypassPermissions … Allow rules have no effect in bypassPermissions"); https://code.claude.com/docs/en/permissions (deny-at-any-level, separator list, stripped-wrapper list)Direct quotes. Correction: the candidate listed env among stripped wrappers; the docs' list is timeout, time, nice, nohup, stdbuf, command, builtin, noglob plus a leading VAR=valueenv is not stripped. Page says soverified
3a9ebd8fda72aade6Slow Kotlin build + Exception during IR lowering → suspect heap; raise Gradle + Kotlin daemon heap at user levelhttps://docs.gradle.org/current/userguide/build_environment.html (user-level precedence quote); https://kotlinlang.org/docs/gradle-compilation-and-caches.html (kotlin.daemon.jvmargs vs -Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits -Xmx)Docs fetched and the property keys re-grepped from the raw HTML by me. Correction: the candidate's kotlin.daemon.jvm.options=-Xmx4g line is a system property valid only inside org.gradle.jvmargs; the Gradle key is kotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)field-tested; page keeps the compiler-defect hypothesis explicit
444cd212b53946b62Bash-hook guard misses Write/Edit escapes; on escalation check main git status, transfer by patch (diffapply --check/applycheckout --)https://code.claude.com/docs/en/hooks (matcher Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--check quote)Mechanics doc-confirmed; the recovery recipe is the session's field reproduction (lo-2 files transferred, main restored, MAIN_CLEAN). Merged into a page already verifiedverified page, field-tested addition
52e3d108012a7e164Unbound method extraction loses this; bind at extraction; a vi.fn() test cannot catch ithttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this; https://vitest.dev/api/mock.htmlnode -e repro: unbound → TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest's mock.contexts records this per call, so a vi.fn() test can catch it when it asserts mock.contexts[0] === obj; page offers that as the third test shapeverified
628897d4a24a46ae9Parallel branches green alone can fail on merge (E0004); build+test the merged tree before dispatching dependentshttps://martinfowler.com/bliki/SemanticConflict.html; https://git-scm.com/docs/git-merge; https://doc.rust-lang.org/error_codes/E0004.htmlQuotes: "safely merged on a textual level but cause the program to behave differently"; git merge documented as textual 3-way only; E0004 non-exhaustive patterns. Field run slk1 as the reproductionverified
7f978fd126f72956fWrite the interpreter by path in worker briefs; measure and record the baseline Ran N / failures=M firsthttps://docs.python.org/3/library/venv.html ("You don't specifically need to activate…"); https://docs.python.org/3/library/unittest.htmlDocs quoted; Ran 3 tests … FAILED (failures=1, errors=1) reproduced locally; field measurement 3532/15+18 vs 3549/1verified (baseline-recording half is process advice grounded in completion-claims)
8076309143096ed63A substring doc-coverage gate is vacuous; scope to heading lines with word boundaries; falsify against a known-bad revisionhttps://testing.googleblog.com/2020/08/code-coverage-best-practices.html ("Mutation testing can help detect such false coverage"); the page's existing mutation-testing and RuleTester sourcesSource fetched; field reproduction (commit 7bdbb1c: pre-fix doc → missing: ['grammar'])verified sources, merged into a field-tested page
95d4a63ae21e06d9eAfter an auditor reports mutation testing on your uncommitted tree, diff against a pre-audit patch and re-run the suite yourselfhttps://git-scm.com/docs/git-checkout (checkout -- <path> discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's own agents/test-quality-auditor.md (restore mechanism)Docs quoted; repo file read; wiki's own caveat (untracked file diffs clean either way) supports the independent check. The "session must verify independently" step is the session's practice, not an external normfield-tested
10d3d8fdcc202b8760tmux ls sees one server only; before resuming as coordinator, prove no live coordinator via ps + artifact mtimesman tmux (list-sessions scoped to a server; -L/-S); man ps (-A, -o lstart,command); repo skills/orchestrate/SKILL.md re-entry sectionMan pages read; nuance added: a missing watcher process alone proves nothing (coordinator between polls), only presence proves liveness — page states both-absences rule. Field run: PID 54780 alive on ssh pty, duplicate commits on t3field-tested (man-page facts verified)
1187d2a59d6b82953cargparse required=True accepts ""; realpath("") is the CWD; reject empty before resolvinghttps://docs.python.org/3/library/argparse.html#required; https://docs.python.org/3/library/os.path.html#os.path.abspathQuotes; local repro parse_args(["--out",""])Namespace(out=''), realpath('') → cwdverified
12f301809d865f8865Guard bats suite inside a worker floods the run's escalation dir and reads the worktree's sandbox config via upward traversal; override the env + run from a clean cwdhttps://bats-core.readthedocs.io/en/stable/writing-tests.html (bats-run-* naming); repo skills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard source groundwork/plugins/guardrails/hooks/bash-guard.sh + its bats tests (the two named tests do not cd into their tmpdir)Mechanism confirmed by reading the real scripts; the 175-record count is the session's observationfield-tested

Existing-layer check

Routing went through INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.

Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite

Per candidate:

#Overlap foundDecision
1unicode-text-matching already has a generic "quantifier over non-ASCII → test on both userlands" rowMerged into it: +1 edge row (last-byte binding under C, grouping fix), +1 Instead-of row, +2 sources; related +bsd-vs-gnu-cli both ways
2agent-permission-classifier-denials has the deny tier in its precedence table but is scoped to auto-mode classifier denials; worktree-isolated-workers covers path isolation, not command classesNew pageplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-pass
3threads-and-memory covers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsNew pagebackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testing
4worktree-isolated-workers already carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowMerged: +1 edge row (escalation-time main-tree check + patch transfer, complete hook matcher), +1 Instead-of row, +git-apply source, +field reproduction. No conflict with the existing directive — it extends it
5what-to-mock and tests-that-cannot-fail cover mock-hides-bug generally; nothing on this bindingNew pagetesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choice
6shared-run-state (default branch moved), cross-module-consumer-census (integration-time census), widening-a-closed-value-table (enum/table widening) are adjacent; none covers the post-merge build gateNew pageinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claims
7path-resolution (pin binaries in automation), version-management (shims absent non-interactively), completion-claims (dropped total = red) each hold one thirdNew pageinfrastructure/agent-orchestration/verify-command-in-a-worker-brief composing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workers
8spec-document-gates axis table ("token survives in a nearby paragraph"), spec-artifact-checks (negative control per check), checks-that-cannot-pass (known-good/known-bad) already own the principleMerged into spec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additions
9tests-that-cannot-fail (restore mechanism by commit state; multi-agent shared tree), mutation-harness-file-custody (untracked file diffs clean either way), completion-claims (relaying subagent reports)Merged into completion-claims claim/evidence table (+1 row, +git-checkout source, +field reproduction); related +mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)
10shared-run-state step 3 confirms a foreign run from the repo; autonomous-decision-rulings step 3 re-reads the ledger on resumeMerged into shared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope, ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproduction
11path-valued-config already rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputsMerged: When-this-applies widened to required CLI flags, "" added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sources
12test-data-and-isolation already has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)Merged (delta only): +1 edge row (cwd-walking config discovery + override the exported escalation dir), +bats source, +field reproduction; coordinator-side cleanup row added to shared-run-state

Conflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.

Open-PR check

gh pr list --repo choiyounggi/dev-loop --state open --json number,headRefName,title --search "head:knowledge/"

returned no rows, and gh pr list --state open --limit 50 (any head) also returned no rows at flush time (2026-09-03 17:28 KST, as choiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.

Per-candidate verdict: all 12 → new (no overlapping open head).

Routing decision

#TargetCategory fit
1platforms/environment/unicode-text-matching (merge)existing
2platforms/tools/deny-rules-under-bypassed-permissions (new page)tools already holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new category
3backend/java/kotlin/compiler-daemon-heap-pressure (new page)kotlin is the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new category
4infrastructure/agent-orchestration/worktree-isolated-workers (merge)existing
5testing/mocking/extracted-method-this-binding (new page)the changed artifact is the test's mock choice → mocking; frontend has no language-mechanics category and the lesson is not React-specific
6infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (new page)the coordinator's integration step owns the merged tree → agent-orchestration
7infrastructure/agent-orchestration/verify-command-in-a-worker-brief (new page)brief authoring is agent-orchestration (same category as worktree-isolated-workers' brief rules)
8qa/document-verification/spec-document-gates (merge)existing
9qa/process/completion-claims (merge)existing
10infrastructure/agent-orchestration/shared-run-state (merge)existing
11infrastructure/config/path-valued-config (merge)existing
12testing/data/test-data-and-isolation (merge) + shared-run-state (coordinator side)existing

No new category was needed. Indexes updated: wiki/platforms/index.md, wiki/infrastructure/index.md, wiki/backend/java/index.md, wiki/testing/index.md, wiki/qa/index.md, root INDEX.md (infrastructure and platforms route lines); log.md appended.

Checks run before the PR: node scripts/wiki-lint-prohibitions.js wiki, node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over every related: id, inline [id] reference, and page-to-index listing (results in the PR conversation).

5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated.
New: platforms/tools/deny-rules-under-bypassed-permissions,
infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge,
infrastructure/agent-orchestration/verify-command-in-a-worker-brief,
backend/java/kotlin/compiler-daemon-heap-pressure,
testing/mocking/extracted-method-this-binding.
Amended: unicode-text-matching, worktree-isolated-workers,
spec-document-gates, path-valued-config, completion-claims,
shared-run-state, test-data-and-isolation.
See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
…kers (pre-write escape deny + --git-common-dir mechanism)
@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: worktree-isolated-workers gains Do-this step 7 (state dirs named worktree-relative; --git-common-dir vs --show-toplevel mechanism), a pre-write worktree_escape deny + relative-path edge-case row, an Instead-of row, and two source lines. Disjoint from this PR's post-hoc patch-transfer row. Lint: 0 violations, 0 structure findings.

@github-actions

Copy link
Copy Markdown

Wiki agent gate: fail

PR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via related:, so neither triggers the advisory rule. Fact check: 18 of 19 newly-cited external quotes were WebFetched and confirmed accurate (I independently re-fetched the 19th myself to verify). One blocker: a source citation on wiki/qa/document-verification/spec-document-gates.md attributes a sentence to the Google Testing Blog article body when it is actually a reader's comment on that page, not the article's own content.

  • blocker [fact] wiki/qa/document-verification/spec-document-gates.md — The Sources entry "https://testing.googleblog.com/2020/08/code-coverage-best-practices.html — ... 'Mutation testing can help detect such false coverage' — the same presence-versus-verification gap a substring gate has" cites that sentence as if it were the article's own content. I fetched the page directly: the sentence is not in the Google-authored article body — it appears only in a reader comment posted by a commenter ("Дмитрий", Oct 2020) responding to another reader. Citing a blog comment as if it were the article misrepresents the source's authority for a claim this page uses to justify adding mutation testing as a coverage-gate remedy. Fix: either drop the citation and rely on the page's own field reproduction (commit 7bdbb1c) plus the already-cited https://testing.googleblog.com/2021/04/mutation-testing.html source (already in this page's frontmatter sources: list and directly on-topic), or explicitly attribute the quote as a reader comment rather than the article.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Fold from the 2026-09-03 20:38 flush (queue hash 3e979f78): pushed 84eefc9 — extends the worktree_escape recovery row in worktree-isolated-workers with "stop the escaping worker before lifting the patch" and mtime-based attribution when several workers are in flight, adds an edge-case row for the symptom "an unrelated test fails right after a merge / the integration branch in main is dirty" (escaped edits ride into the next merge commit as another task's work), plus the linkly t112 field evidence (11 misattributed failures cleared). Candidate retired as folded; no sibling PR opened.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:

  • verify-command-in-a-worker-brief: edge-case + instead-of rows — a task whose deliverable is a numbered/spec document in a repo with README-count / generated-reference currency gates names those gate tests on its own verify line (field evidence: linkly run enf0829, 10 integration failures from one missing RFC_ROUTES["0043"] entry).
  • worktree-isolated-workers: instead-of row — when the Bash-only guard matcher cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (field evidence: linkly 2026-08-26, three Edit-tool writes passed silently while a Bash diff tripped the guard).

Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev-loop:knowledgeAuto-opened wiki knowledge ingest PR (owner reviews & merges)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@choiyounggi
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179

Open
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728
Open

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges)#179
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728

Conversation

@choiyounggi

Copy link
Copy Markdown
Owner

Knowledge flush — 12 insight(s)

Batch: 12 of 109 pending candidates were claimed (queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).

Verified best-practice

#Candidate (hash)ClaimSources checked (fetched/read)How verifiedConfidence
12002a817b2e74f84A quantifier after a non-ASCII literal binds to the last UTF-8 byte under LC_ALL=C; group it (─){3,} and test under CPOSIX grep spec (already cited on the page); bug-grep list thread on unibyte vs multibyte code pathsReproduced on macOS BSD grep 2.6.0-FreeBSD and BSD sed: ─{3,} → 0 under C, 1 under UTF-8; (─){3,} → 1 in both; a + two bare 0x80 bytes matches ─{3,} under C (last-byte binding). GNU grep not installed → GNU result stated as untestedverified (BSD); GNU untested, said so on the page
26b8811c6c3b0f983permissions.deny is enforced in bypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedhttps://code.claude.com/docs/en/permission-modes ("Deny rules block in every mode, including bypassPermissions … Allow rules have no effect in bypassPermissions"); https://code.claude.com/docs/en/permissions (deny-at-any-level, separator list, stripped-wrapper list)Direct quotes. Correction: the candidate listed env among stripped wrappers; the docs' list is timeout, time, nice, nohup, stdbuf, command, builtin, noglob plus a leading VAR=valueenv is not stripped. Page says soverified
3a9ebd8fda72aade6Slow Kotlin build + Exception during IR lowering → suspect heap; raise Gradle + Kotlin daemon heap at user levelhttps://docs.gradle.org/current/userguide/build_environment.html (user-level precedence quote); https://kotlinlang.org/docs/gradle-compilation-and-caches.html (kotlin.daemon.jvmargs vs -Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits -Xmx)Docs fetched and the property keys re-grepped from the raw HTML by me. Correction: the candidate's kotlin.daemon.jvm.options=-Xmx4g line is a system property valid only inside org.gradle.jvmargs; the Gradle key is kotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)field-tested; page keeps the compiler-defect hypothesis explicit
444cd212b53946b62Bash-hook guard misses Write/Edit escapes; on escalation check main git status, transfer by patch (diffapply --check/applycheckout --)https://code.claude.com/docs/en/hooks (matcher Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--check quote)Mechanics doc-confirmed; the recovery recipe is the session's field reproduction (lo-2 files transferred, main restored, MAIN_CLEAN). Merged into a page already verifiedverified page, field-tested addition
52e3d108012a7e164Unbound method extraction loses this; bind at extraction; a vi.fn() test cannot catch ithttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this; https://vitest.dev/api/mock.htmlnode -e repro: unbound → TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest's mock.contexts records this per call, so a vi.fn() test can catch it when it asserts mock.contexts[0] === obj; page offers that as the third test shapeverified
628897d4a24a46ae9Parallel branches green alone can fail on merge (E0004); build+test the merged tree before dispatching dependentshttps://martinfowler.com/bliki/SemanticConflict.html; https://git-scm.com/docs/git-merge; https://doc.rust-lang.org/error_codes/E0004.htmlQuotes: "safely merged on a textual level but cause the program to behave differently"; git merge documented as textual 3-way only; E0004 non-exhaustive patterns. Field run slk1 as the reproductionverified
7f978fd126f72956fWrite the interpreter by path in worker briefs; measure and record the baseline Ran N / failures=M firsthttps://docs.python.org/3/library/venv.html ("You don't specifically need to activate…"); https://docs.python.org/3/library/unittest.htmlDocs quoted; Ran 3 tests … FAILED (failures=1, errors=1) reproduced locally; field measurement 3532/15+18 vs 3549/1verified (baseline-recording half is process advice grounded in completion-claims)
8076309143096ed63A substring doc-coverage gate is vacuous; scope to heading lines with word boundaries; falsify against a known-bad revisionhttps://testing.googleblog.com/2020/08/code-coverage-best-practices.html ("Mutation testing can help detect such false coverage"); the page's existing mutation-testing and RuleTester sourcesSource fetched; field reproduction (commit 7bdbb1c: pre-fix doc → missing: ['grammar'])verified sources, merged into a field-tested page
95d4a63ae21e06d9eAfter an auditor reports mutation testing on your uncommitted tree, diff against a pre-audit patch and re-run the suite yourselfhttps://git-scm.com/docs/git-checkout (checkout -- <path> discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's own agents/test-quality-auditor.md (restore mechanism)Docs quoted; repo file read; wiki's own caveat (untracked file diffs clean either way) supports the independent check. The "session must verify independently" step is the session's practice, not an external normfield-tested
10d3d8fdcc202b8760tmux ls sees one server only; before resuming as coordinator, prove no live coordinator via ps + artifact mtimesman tmux (list-sessions scoped to a server; -L/-S); man ps (-A, -o lstart,command); repo skills/orchestrate/SKILL.md re-entry sectionMan pages read; nuance added: a missing watcher process alone proves nothing (coordinator between polls), only presence proves liveness — page states both-absences rule. Field run: PID 54780 alive on ssh pty, duplicate commits on t3field-tested (man-page facts verified)
1187d2a59d6b82953cargparse required=True accepts ""; realpath("") is the CWD; reject empty before resolvinghttps://docs.python.org/3/library/argparse.html#required; https://docs.python.org/3/library/os.path.html#os.path.abspathQuotes; local repro parse_args(["--out",""])Namespace(out=''), realpath('') → cwdverified
12f301809d865f8865Guard bats suite inside a worker floods the run's escalation dir and reads the worktree's sandbox config via upward traversal; override the env + run from a clean cwdhttps://bats-core.readthedocs.io/en/stable/writing-tests.html (bats-run-* naming); repo skills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard source groundwork/plugins/guardrails/hooks/bash-guard.sh + its bats tests (the two named tests do not cd into their tmpdir)Mechanism confirmed by reading the real scripts; the 175-record count is the session's observationfield-tested

Existing-layer check

Routing went through INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.

Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite

Per candidate:

#Overlap foundDecision
1unicode-text-matching already has a generic "quantifier over non-ASCII → test on both userlands" rowMerged into it: +1 edge row (last-byte binding under C, grouping fix), +1 Instead-of row, +2 sources; related +bsd-vs-gnu-cli both ways
2agent-permission-classifier-denials has the deny tier in its precedence table but is scoped to auto-mode classifier denials; worktree-isolated-workers covers path isolation, not command classesNew pageplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-pass
3threads-and-memory covers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsNew pagebackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testing
4worktree-isolated-workers already carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowMerged: +1 edge row (escalation-time main-tree check + patch transfer, complete hook matcher), +1 Instead-of row, +git-apply source, +field reproduction. No conflict with the existing directive — it extends it
5what-to-mock and tests-that-cannot-fail cover mock-hides-bug generally; nothing on this bindingNew pagetesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choice
6shared-run-state (default branch moved), cross-module-consumer-census (integration-time census), widening-a-closed-value-table (enum/table widening) are adjacent; none covers the post-merge build gateNew pageinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claims
7path-resolution (pin binaries in automation), version-management (shims absent non-interactively), completion-claims (dropped total = red) each hold one thirdNew pageinfrastructure/agent-orchestration/verify-command-in-a-worker-brief composing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workers
8spec-document-gates axis table ("token survives in a nearby paragraph"), spec-artifact-checks (negative control per check), checks-that-cannot-pass (known-good/known-bad) already own the principleMerged into spec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additions
9tests-that-cannot-fail (restore mechanism by commit state; multi-agent shared tree), mutation-harness-file-custody (untracked file diffs clean either way), completion-claims (relaying subagent reports)Merged into completion-claims claim/evidence table (+1 row, +git-checkout source, +field reproduction); related +mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)
10shared-run-state step 3 confirms a foreign run from the repo; autonomous-decision-rulings step 3 re-reads the ledger on resumeMerged into shared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope, ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproduction
11path-valued-config already rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputsMerged: When-this-applies widened to required CLI flags, "" added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sources
12test-data-and-isolation already has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)Merged (delta only): +1 edge row (cwd-walking config discovery + override the exported escalation dir), +bats source, +field reproduction; coordinator-side cleanup row added to shared-run-state

Conflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.

Open-PR check

gh pr list --repo choiyounggi/dev-loop --state open --json number,headRefName,title --search "head:knowledge/"

returned no rows, and gh pr list --state open --limit 50 (any head) also returned no rows at flush time (2026-09-03 17:28 KST, as choiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.

Per-candidate verdict: all 12 → new (no overlapping open head).

Routing decision

#TargetCategory fit
1platforms/environment/unicode-text-matching (merge)existing
2platforms/tools/deny-rules-under-bypassed-permissions (new page)tools already holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new category
3backend/java/kotlin/compiler-daemon-heap-pressure (new page)kotlin is the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new category
4infrastructure/agent-orchestration/worktree-isolated-workers (merge)existing
5testing/mocking/extracted-method-this-binding (new page)the changed artifact is the test's mock choice → mocking; frontend has no language-mechanics category and the lesson is not React-specific
6infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (new page)the coordinator's integration step owns the merged tree → agent-orchestration
7infrastructure/agent-orchestration/verify-command-in-a-worker-brief (new page)brief authoring is agent-orchestration (same category as worktree-isolated-workers' brief rules)
8qa/document-verification/spec-document-gates (merge)existing
9qa/process/completion-claims (merge)existing
10infrastructure/agent-orchestration/shared-run-state (merge)existing
11infrastructure/config/path-valued-config (merge)existing
12testing/data/test-data-and-isolation (merge) + shared-run-state (coordinator side)existing

No new category was needed. Indexes updated: wiki/platforms/index.md, wiki/infrastructure/index.md, wiki/backend/java/index.md, wiki/testing/index.md, wiki/qa/index.md, root INDEX.md (infrastructure and platforms route lines); log.md appended.

Checks run before the PR: node scripts/wiki-lint-prohibitions.js wiki, node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over every related: id, inline [id] reference, and page-to-index listing (results in the PR conversation).

5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated.
New: platforms/tools/deny-rules-under-bypassed-permissions,
infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge,
infrastructure/agent-orchestration/verify-command-in-a-worker-brief,
backend/java/kotlin/compiler-daemon-heap-pressure,
testing/mocking/extracted-method-this-binding.
Amended: unicode-text-matching, worktree-isolated-workers,
spec-document-gates, path-valued-config, completion-claims,
shared-run-state, test-data-and-isolation.
See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
…kers (pre-write escape deny + --git-common-dir mechanism)
@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: worktree-isolated-workers gains Do-this step 7 (state dirs named worktree-relative; --git-common-dir vs --show-toplevel mechanism), a pre-write worktree_escape deny + relative-path edge-case row, an Instead-of row, and two source lines. Disjoint from this PR's post-hoc patch-transfer row. Lint: 0 violations, 0 structure findings.

@github-actions

Copy link
Copy Markdown

Wiki agent gate: fail

PR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via related:, so neither triggers the advisory rule. Fact check: 18 of 19 newly-cited external quotes were WebFetched and confirmed accurate (I independently re-fetched the 19th myself to verify). One blocker: a source citation on wiki/qa/document-verification/spec-document-gates.md attributes a sentence to the Google Testing Blog article body when it is actually a reader's comment on that page, not the article's own content.

  • blocker [fact] wiki/qa/document-verification/spec-document-gates.md — The Sources entry "https://testing.googleblog.com/2020/08/code-coverage-best-practices.html — ... 'Mutation testing can help detect such false coverage' — the same presence-versus-verification gap a substring gate has" cites that sentence as if it were the article's own content. I fetched the page directly: the sentence is not in the Google-authored article body — it appears only in a reader comment posted by a commenter ("Дмитрий", Oct 2020) responding to another reader. Citing a blog comment as if it were the article misrepresents the source's authority for a claim this page uses to justify adding mutation testing as a coverage-gate remedy. Fix: either drop the citation and rely on the page's own field reproduction (commit 7bdbb1c) plus the already-cited https://testing.googleblog.com/2021/04/mutation-testing.html source (already in this page's frontmatter sources: list and directly on-topic), or explicitly attribute the quote as a reader comment rather than the article.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Fold from the 2026-09-03 20:38 flush (queue hash 3e979f78): pushed 84eefc9 — extends the worktree_escape recovery row in worktree-isolated-workers with "stop the escaping worker before lifting the patch" and mtime-based attribution when several workers are in flight, adds an edge-case row for the symptom "an unrelated test fails right after a merge / the integration branch in main is dirty" (escaped edits ride into the next merge commit as another task's work), plus the linkly t112 field evidence (11 misattributed failures cleared). Candidate retired as folded; no sibling PR opened.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:

  • verify-command-in-a-worker-brief: edge-case + instead-of rows — a task whose deliverable is a numbered/spec document in a repo with README-count / generated-reference currency gates names those gate tests on its own verify line (field evidence: linkly run enf0829, 10 integration failures from one missing RFC_ROUTES["0043"] entry).
  • worktree-isolated-workers: instead-of row — when the Bash-only guard matcher cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (field evidence: linkly 2026-08-26, three Edit-tool writes passed silently while a Bash diff tripped the guard).

Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev-loop:knowledgeAuto-opened wiki knowledge ingest PR (owner reviews & merges)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@choiyounggi
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179

Open
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728
Open

knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges)#179
choiyounggi wants to merge 4 commits into
mainfrom
knowledge/choiyounggi-20260903-172728

Conversation

@choiyounggi

Copy link
Copy Markdown
Owner

Knowledge flush — 12 insight(s)

Batch: 12 of 109 pending candidates were claimed (queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).

Verified best-practice

#Candidate (hash)ClaimSources checked (fetched/read)How verifiedConfidence
12002a817b2e74f84A quantifier after a non-ASCII literal binds to the last UTF-8 byte under LC_ALL=C; group it (─){3,} and test under CPOSIX grep spec (already cited on the page); bug-grep list thread on unibyte vs multibyte code pathsReproduced on macOS BSD grep 2.6.0-FreeBSD and BSD sed: ─{3,} → 0 under C, 1 under UTF-8; (─){3,} → 1 in both; a + two bare 0x80 bytes matches ─{3,} under C (last-byte binding). GNU grep not installed → GNU result stated as untestedverified (BSD); GNU untested, said so on the page
26b8811c6c3b0f983permissions.deny is enforced in bypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedhttps://code.claude.com/docs/en/permission-modes ("Deny rules block in every mode, including bypassPermissions … Allow rules have no effect in bypassPermissions"); https://code.claude.com/docs/en/permissions (deny-at-any-level, separator list, stripped-wrapper list)Direct quotes. Correction: the candidate listed env among stripped wrappers; the docs' list is timeout, time, nice, nohup, stdbuf, command, builtin, noglob plus a leading VAR=valueenv is not stripped. Page says soverified
3a9ebd8fda72aade6Slow Kotlin build + Exception during IR lowering → suspect heap; raise Gradle + Kotlin daemon heap at user levelhttps://docs.gradle.org/current/userguide/build_environment.html (user-level precedence quote); https://kotlinlang.org/docs/gradle-compilation-and-caches.html (kotlin.daemon.jvmargs vs -Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits -Xmx)Docs fetched and the property keys re-grepped from the raw HTML by me. Correction: the candidate's kotlin.daemon.jvm.options=-Xmx4g line is a system property valid only inside org.gradle.jvmargs; the Gradle key is kotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)field-tested; page keeps the compiler-defect hypothesis explicit
444cd212b53946b62Bash-hook guard misses Write/Edit escapes; on escalation check main git status, transfer by patch (diffapply --check/applycheckout --)https://code.claude.com/docs/en/hooks (matcher Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--check quote)Mechanics doc-confirmed; the recovery recipe is the session's field reproduction (lo-2 files transferred, main restored, MAIN_CLEAN). Merged into a page already verifiedverified page, field-tested addition
52e3d108012a7e164Unbound method extraction loses this; bind at extraction; a vi.fn() test cannot catch ithttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/this; https://vitest.dev/api/mock.htmlnode -e repro: unbound → TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest's mock.contexts records this per call, so a vi.fn() test can catch it when it asserts mock.contexts[0] === obj; page offers that as the third test shapeverified
628897d4a24a46ae9Parallel branches green alone can fail on merge (E0004); build+test the merged tree before dispatching dependentshttps://martinfowler.com/bliki/SemanticConflict.html; https://git-scm.com/docs/git-merge; https://doc.rust-lang.org/error_codes/E0004.htmlQuotes: "safely merged on a textual level but cause the program to behave differently"; git merge documented as textual 3-way only; E0004 non-exhaustive patterns. Field run slk1 as the reproductionverified
7f978fd126f72956fWrite the interpreter by path in worker briefs; measure and record the baseline Ran N / failures=M firsthttps://docs.python.org/3/library/venv.html ("You don't specifically need to activate…"); https://docs.python.org/3/library/unittest.htmlDocs quoted; Ran 3 tests … FAILED (failures=1, errors=1) reproduced locally; field measurement 3532/15+18 vs 3549/1verified (baseline-recording half is process advice grounded in completion-claims)
8076309143096ed63A substring doc-coverage gate is vacuous; scope to heading lines with word boundaries; falsify against a known-bad revisionhttps://testing.googleblog.com/2020/08/code-coverage-best-practices.html ("Mutation testing can help detect such false coverage"); the page's existing mutation-testing and RuleTester sourcesSource fetched; field reproduction (commit 7bdbb1c: pre-fix doc → missing: ['grammar'])verified sources, merged into a field-tested page
95d4a63ae21e06d9eAfter an auditor reports mutation testing on your uncommitted tree, diff against a pre-audit patch and re-run the suite yourselfhttps://git-scm.com/docs/git-checkout (checkout -- <path> discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's own agents/test-quality-auditor.md (restore mechanism)Docs quoted; repo file read; wiki's own caveat (untracked file diffs clean either way) supports the independent check. The "session must verify independently" step is the session's practice, not an external normfield-tested
10d3d8fdcc202b8760tmux ls sees one server only; before resuming as coordinator, prove no live coordinator via ps + artifact mtimesman tmux (list-sessions scoped to a server; -L/-S); man ps (-A, -o lstart,command); repo skills/orchestrate/SKILL.md re-entry sectionMan pages read; nuance added: a missing watcher process alone proves nothing (coordinator between polls), only presence proves liveness — page states both-absences rule. Field run: PID 54780 alive on ssh pty, duplicate commits on t3field-tested (man-page facts verified)
1187d2a59d6b82953cargparse required=True accepts ""; realpath("") is the CWD; reject empty before resolvinghttps://docs.python.org/3/library/argparse.html#required; https://docs.python.org/3/library/os.path.html#os.path.abspathQuotes; local repro parse_args(["--out",""])Namespace(out=''), realpath('') → cwdverified
12f301809d865f8865Guard bats suite inside a worker floods the run's escalation dir and reads the worktree's sandbox config via upward traversal; override the env + run from a clean cwdhttps://bats-core.readthedocs.io/en/stable/writing-tests.html (bats-run-* naming); repo skills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard source groundwork/plugins/guardrails/hooks/bash-guard.sh + its bats tests (the two named tests do not cd into their tmpdir)Mechanism confirmed by reading the real scripts; the 175-record count is the session's observationfield-tested

Existing-layer check

Routing went through INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.

Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite

Per candidate:

#Overlap foundDecision
1unicode-text-matching already has a generic "quantifier over non-ASCII → test on both userlands" rowMerged into it: +1 edge row (last-byte binding under C, grouping fix), +1 Instead-of row, +2 sources; related +bsd-vs-gnu-cli both ways
2agent-permission-classifier-denials has the deny tier in its precedence table but is scoped to auto-mode classifier denials; worktree-isolated-workers covers path isolation, not command classesNew pageplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-pass
3threads-and-memory covers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsNew pagebackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testing
4worktree-isolated-workers already carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowMerged: +1 edge row (escalation-time main-tree check + patch transfer, complete hook matcher), +1 Instead-of row, +git-apply source, +field reproduction. No conflict with the existing directive — it extends it
5what-to-mock and tests-that-cannot-fail cover mock-hides-bug generally; nothing on this bindingNew pagetesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choice
6shared-run-state (default branch moved), cross-module-consumer-census (integration-time census), widening-a-closed-value-table (enum/table widening) are adjacent; none covers the post-merge build gateNew pageinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claims
7path-resolution (pin binaries in automation), version-management (shims absent non-interactively), completion-claims (dropped total = red) each hold one thirdNew pageinfrastructure/agent-orchestration/verify-command-in-a-worker-brief composing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workers
8spec-document-gates axis table ("token survives in a nearby paragraph"), spec-artifact-checks (negative control per check), checks-that-cannot-pass (known-good/known-bad) already own the principleMerged into spec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additions
9tests-that-cannot-fail (restore mechanism by commit state; multi-agent shared tree), mutation-harness-file-custody (untracked file diffs clean either way), completion-claims (relaying subagent reports)Merged into completion-claims claim/evidence table (+1 row, +git-checkout source, +field reproduction); related +mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)
10shared-run-state step 3 confirms a foreign run from the repo; autonomous-decision-rulings step 3 re-reads the ledger on resumeMerged into shared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope, ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproduction
11path-valued-config already rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputsMerged: When-this-applies widened to required CLI flags, "" added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sources
12test-data-and-isolation already has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)Merged (delta only): +1 edge row (cwd-walking config discovery + override the exported escalation dir), +bats source, +field reproduction; coordinator-side cleanup row added to shared-run-state

Conflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.

Open-PR check

gh pr list --repo choiyounggi/dev-loop --state open --json number,headRefName,title --search "head:knowledge/"

returned no rows, and gh pr list --state open --limit 50 (any head) also returned no rows at flush time (2026-09-03 17:28 KST, as choiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.

Per-candidate verdict: all 12 → new (no overlapping open head).

Routing decision

#TargetCategory fit
1platforms/environment/unicode-text-matching (merge)existing
2platforms/tools/deny-rules-under-bypassed-permissions (new page)tools already holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new category
3backend/java/kotlin/compiler-daemon-heap-pressure (new page)kotlin is the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new category
4infrastructure/agent-orchestration/worktree-isolated-workers (merge)existing
5testing/mocking/extracted-method-this-binding (new page)the changed artifact is the test's mock choice → mocking; frontend has no language-mechanics category and the lesson is not React-specific
6infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge (new page)the coordinator's integration step owns the merged tree → agent-orchestration
7infrastructure/agent-orchestration/verify-command-in-a-worker-brief (new page)brief authoring is agent-orchestration (same category as worktree-isolated-workers' brief rules)
8qa/document-verification/spec-document-gates (merge)existing
9qa/process/completion-claims (merge)existing
10infrastructure/agent-orchestration/shared-run-state (merge)existing
11infrastructure/config/path-valued-config (merge)existing
12testing/data/test-data-and-isolation (merge) + shared-run-state (coordinator side)existing

No new category was needed. Indexes updated: wiki/platforms/index.md, wiki/infrastructure/index.md, wiki/backend/java/index.md, wiki/testing/index.md, wiki/qa/index.md, root INDEX.md (infrastructure and platforms route lines); log.md appended.

Checks run before the PR: node scripts/wiki-lint-prohibitions.js wiki, node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over every related: id, inline [id] reference, and page-to-index listing (results in the PR conversation).

5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated.
New: platforms/tools/deny-rules-under-bypassed-permissions,
infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge,
infrastructure/agent-orchestration/verify-command-in-a-worker-brief,
backend/java/kotlin/compiler-daemon-heap-pressure,
testing/mocking/extracted-method-this-binding.
Amended: unicode-text-matching, worktree-isolated-workers,
spec-document-gates, path-valued-config, completion-claims,
shared-run-state, test-data-and-isolation.
See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
…kers (pre-write escape deny + --git-common-dir mechanism)
@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: worktree-isolated-workers gains Do-this step 7 (state dirs named worktree-relative; --git-common-dir vs --show-toplevel mechanism), a pre-write worktree_escape deny + relative-path edge-case row, an Instead-of row, and two source lines. Disjoint from this PR's post-hoc patch-transfer row. Lint: 0 violations, 0 structure findings.

@github-actions

Copy link
Copy Markdown

Wiki agent gate: fail

PR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via related:, so neither triggers the advisory rule. Fact check: 18 of 19 newly-cited external quotes were WebFetched and confirmed accurate (I independently re-fetched the 19th myself to verify). One blocker: a source citation on wiki/qa/document-verification/spec-document-gates.md attributes a sentence to the Google Testing Blog article body when it is actually a reader's comment on that page, not the article's own content.

  • blocker [fact] wiki/qa/document-verification/spec-document-gates.md — The Sources entry "https://testing.googleblog.com/2020/08/code-coverage-best-practices.html — ... 'Mutation testing can help detect such false coverage' — the same presence-versus-verification gap a substring gate has" cites that sentence as if it were the article's own content. I fetched the page directly: the sentence is not in the Google-authored article body — it appears only in a reader comment posted by a commenter ("Дмитрий", Oct 2020) responding to another reader. Citing a blog comment as if it were the article misrepresents the source's authority for a claim this page uses to justify adding mutation testing as a coverage-gate remedy. Fix: either drop the citation and rely on the page's own field reproduction (commit 7bdbb1c) plus the already-cited https://testing.googleblog.com/2021/04/mutation-testing.html source (already in this page's frontmatter sources: list and directly on-topic), or explicitly attribute the quote as a reader comment rather than the article.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Fold from the 2026-09-03 20:38 flush (queue hash 3e979f78): pushed 84eefc9 — extends the worktree_escape recovery row in worktree-isolated-workers with "stop the escaping worker before lifting the patch" and mtime-based attribution when several workers are in flight, adds an edge-case row for the symptom "an unrelated test fails right after a merge / the integration branch in main is dirty" (escaped edits ride into the next merge commit as another task's work), plus the linkly t112 field evidence (11 misattributed failures cleared). Candidate retired as folded; no sibling PR opened.

@choiyounggi

Copy link
Copy Markdown
OwnerAuthor

Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:

  • verify-command-in-a-worker-brief: edge-case + instead-of rows — a task whose deliverable is a numbered/spec document in a repo with README-count / generated-reference currency gates names those gate tests on its own verify line (field evidence: linkly run enf0829, 10 integration failures from one missing RFC_ROUTES["0043"] entry).
  • worktree-isolated-workers: instead-of row — when the Bash-only guard matcher cannot be widened, route worker edits through Bash with worktree-relative paths and post-check main with git status --porcelain (field evidence: linkly 2026-08-26, three Edit-tool writes passed silently while a Bash diff tripped the guard).

Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev-loop:knowledgeAuto-opened wiki knowledge ingest PR (owner reviews & merges)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@choiyounggi