limit 44: "closed for the honest-agent class" was too strong, by one token - #42
limit 44: "closed for the honest-agent class" was too strong, by one token#42githubscum wants to merge 2 commits into
Conversation
…token Post-merge review of PR #33 probed the merged matcher instead of reading it. Four forms of the class the entry calls closed walk past it, each one token from the closing change's own worked examples: the systemd guard requires an '=' where getopt_long accepts a space, and the at(1) time-spec alternation omits the am/pm forms and bare HHMM. Status line downgraded from closed to NARROWED, the measured probe recorded as fail-first evidence, and the two one-line widenings named with the controls they need. Docs only: the matcher is on the non-delegable list and the self-mod gate blocked the edit unsigned during the run that found this. The command was not reshaped to get around it. Ships no test on purpose. A test asserting the fixed behavior would land red while the code waits for a signing sitting. Suite 941/941 green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ilently is not available The amendment on this branch named two options and took the worse one: a test of the fixed behavior lands red while the core fix waits for a signing sitting, so it shipped no test at all. That is how a finding becomes permanent - it lives in prose, and prose can be edited closed. The third option: assert the CURRENT state. A TRIPWIRE block records that the five measured forms are still FREE, with the covered forms beside them as controls so it cannot pass because the matcher stopped working. When the two widenings land, the block fails, and its message says to invert the assertions and amend the entry in the same change rather than delete it. Measured, not read: the forms were re-probed through the shipped isScopeEscalation this run rather than trusted from the prior report. Suite 947 pass / 0 fail, six new. No core file touched; the gate blocked that edit unsigned (request 5177dcbf) and the command was not reshaped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
githubscum
commented
Sep 1, 2026
Update (2026-09-01 16:41 CDT): this branch is no longer docs-only. It now ships a test, and it is the answer to doubt #1 in the body above. The body said this change deliberately ships no test, because a test asserting the fixed behavior would land red while the two widenings wait for a signing sitting. It also said, against itself, that this is exactly how a finding quietly becomes permanent. That doubt was right, and there was a third option neither the body nor the amendment considered. Assert the current state, not the fixed one.
The controls are load-bearing rather than decorative: without them the block would also pass if the matcher stopped working altogether, which would turn a tripwire into a rubber stamp. When the widenings land, the block fails. That is the design. The assertion message tells whoever lands them to invert the assertions, move the cases into the "must gate" block above, and amend the entry in the same change - and explicitly not to delete the block to get green, because a deletion closes the confession without closing the hole, which is the failure this entry already has on its record once. Measured this run, not carried over. The five forms were re-probed through the shipped What a reviewer should doubt, in addition to the two doubts in the body:
Suite: 947 pass / 0 fail, six new. No core file touched. |
The work order
Post-merge review of #33 (authorized on the desk, signed 2026-09-01). The
review verdict is accept and is posted on that PR. This is the finding the
review turned up, filed as its own change.
The defect
Entry 44's status line has read "closed for the honest-agent class" since
2026-08-25. Probing the merged matcher on
mainat6d77e64— rather thanreading it — found four forms of that same class walking past:
Two narrow causes. The systemd guard requires a literal
=, while systemdparses with
getopt_longandrequired_argument, which accepts--on-active 30and registers the identical timer. And the at(1) time-specalternation omits the am/pm forms and bare
HHMM, both of which at(1) takes.These are not a new class. They are the class the closing change fixed,
reached by a spelling the matcher did not remember — the same failure mode one
level down. Against an honest agent it matters more than it looks: nobody
chooses between
--on-active=30and--on-active 30on purpose, so theoperator's record shows a clean session where a gated one belonged.
What this change does
Downgrades the status line from closed to NARROWED, records the probe as
fail-first evidence, and names the two one-line widenings with the controls
they will need (
at 12 filesandgrep at 1200 log.txtare where a widenedtime spec starts firing on prose).
What was tested
npm teston this branch: 941 pass, 0 fail. Same onmainat6d77e64before the edit, so the number is a baseline rather than a claim.
What a reviewer should doubt
non-delegable list; the self-mod gate blocked the edit unsigned during the
run that found this, and the command was not reshaped to get around it. A
test asserting the fixed behavior would land red while the fix waits for a
signing sitting. That is a defensible split and also exactly how a finding
quietly becomes permanent — the honest read is that this PR is a marker,
and the marker is worth less than the two-line fix it describes.
at(1) and getopt semantics, not from running the patched matcher, because
the patch could not be applied.
[0-2]\d[0-5]\dfor bare HHMM is theloosest of the two and is the one most likely to catch prose.
named. It is not a sweep of at(1)'s or systemd's full time-spec grammar,
and there are almost certainly more forms in both.
that four spelling variants are residuals like the ones already listed, and
the entry should have gained a bullet rather than losing its "closed". I
took the stronger action because the existing residual list is scrupulous
and these forms are not in it, so the line was making a promise the code
does not keep.