Skip to content

[DRILL — DO NOT MERGE] seeded-bad floor (greploop posture-B safety proof) - #47

Closed
Kyzcreig wants to merge 2 commits into
mainfrom
drill/seeded-bad-floor-DONOTMERGE
Closed

Kyzcreig wants to merge 2 commits into
mainfrom
drill/seeded-bad-floor-DONOTMERGE

Conversation

@Kyzcreig

Copy link
Copy Markdown
Collaborator

This is an automated safety drill. DO NOT MERGE. It will be closed automatically.

Seeds a deliberately broken deterministic floor to prove hermes-agent's REAL CI checks block it (PRD §8.2 hard oracle):

  • drill_seed/test_drill_seed_DONOTMERGE.py — a failing test → ci MUST go red.
  • drill_seed/leaked_config_DONOTMERGE.txt — a fake (non-functional) AWS-shaped key → secret_scan (gitleaks) MUST go red.

Expected: ci red, secret_scan red → greploop decision engine refuses to ARM even with a perfect score + auto-merge ON. Opened as a draft (no Greptile auto-review/billing). Auto-closed after verification.

@github-actions

github-actions Bot commented Jun 15, 2026 •

Copy link
Copy Markdown

🔎 Lint report: drill/seeded-bad-floor-DONOTMERGE vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9932 on HEAD, 9932 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5134 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

@Kyzcreig Kyzcreig closed this Jun 15, 2026
@Kyzcreig
Kyzcreig deleted the drill/seeded-bad-floor-DONOTMERGE branch June 15, 2026 23:20
Kyzcreig pushed a commit that referenced this pull request Sep 28, 2026
…t_cd88e043)

Rows from t_f4ef102c's CSV (row index #i). Each fix has a test that fails on
base fbfcf03/a290767e19 and passes here.

- #47 kanban_survivor: a submodule gitfile (.git/modules/...) whose target is
  missing was refused as a "dead linked worktree stub". Now only a target under
  .git/worktrees/ counts.
- #64 whatsapp adapter: the npm-install remedy interpolated bridge_dir and the
  npm path unquoted. Both are now shlex.quote'd.
- #86 /kanban dashboard: dashboard_link (reads config.yaml) ran on the event
  loop. Now asyncio.to_thread.
- #12/#63 e2e _owns_transcript_driver: an exception in the interrupt-phase turn
  printed {"interrupted": false} with rc 0. It is now captured and returned as
  rc 4 with the error. The marker path in RUN_TOOL is shlex.quote'd.
- #125/#135 sdlc-review SKILL.md and KANBAN_GUIDANCE: the no-delegation path
  now names batch_id "n/a: <reason>", which the coverage gate accepts
  (asserted).
- #10 test_review_policy_none_skips_every_card patched configured_review_policy
  and then asserted the patch. It now drives the real resolver through
  _board_home_kanban_cfg.
- #28 test_async_hint_is_bounded...: release.set() ran after asyncio.run, so the
  default-executor shutdown waited the full 5 s. Call time: 5.06 s -> 0.20 s.
- #62 test_runtime_tree_is_checked_against_a_real_git_checkout: `git init`
  without -b collided when init.defaultBranch=upstream. Now `-b main`.
- #82 no-network-on-loop gate: added requests.patch/delete and
  httpx.put/patch/delete to the sinks. This surfaced gateway/run.py stop and
  _stop_impl reaching requests.delete (camofox close at shutdown). They are
  baselined as pre-existing; the walker names one sink per coroutine, so they
  replace the old `-> requests.get` keys for the same two coroutines.
- #87 no-agent-construction gate: the alias walker handled ast.Assign only.
  It now handles AnnAssign too (`store: X = self.session_store`).
- Cluster A (16 rows here, 33 fleet-wide): tests/ci/test_no_new_source_proxy_asserts.py
  is a ratchet. It flags any test function that calls getsource and asserts
  with in/not in. The 116 functions in 84 files that match today are frozen
  in source_proxy_baseline.json. A new one fails, and so does a stale key.
  Opt out on the def line with `# noqa: source-proxy <reason>`.
Kyzcreig pushed a commit that referenced this pull request Sep 28, 2026
…t_cd88e043)

Rows from t_f4ef102c's CSV (row index #i). Each fix has a test that fails on
base fbfcf03/a290767e19 and passes here.

- #47 kanban_survivor: a submodule gitfile (.git/modules/...) whose target is
  missing was refused as a "dead linked worktree stub". Now only a target under
  .git/worktrees/ counts.
- #64 whatsapp adapter: the npm-install remedy interpolated bridge_dir and the
  npm path unquoted. Both are now shlex.quote'd.
- #86 /kanban dashboard: dashboard_link (reads config.yaml) ran on the event
  loop. Now asyncio.to_thread.
- #12/#63 e2e _owns_transcript_driver: an exception in the interrupt-phase turn
  printed {"interrupted": false} with rc 0. It is now captured and returned as
  rc 4 with the error. The marker path in RUN_TOOL is shlex.quote'd.
- #125/#135 sdlc-review SKILL.md and KANBAN_GUIDANCE: the no-delegation path
  now names batch_id "n/a: <reason>", which the coverage gate accepts
  (asserted).
- #10 test_review_policy_none_skips_every_card patched configured_review_policy
  and then asserted the patch. It now drives the real resolver through
  _board_home_kanban_cfg.
- #28 test_async_hint_is_bounded...: release.set() ran after asyncio.run, so the
  default-executor shutdown waited the full 5 s. Call time: 5.06 s -> 0.20 s.
- #62 test_runtime_tree_is_checked_against_a_real_git_checkout: `git init`
  without -b collided when init.defaultBranch=upstream. Now `-b main`.
- #82 no-network-on-loop gate: added requests.patch/delete and
  httpx.put/patch/delete to the sinks. This surfaced gateway/run.py stop and
  _stop_impl reaching requests.delete (camofox close at shutdown). They are
  baselined as pre-existing; the walker names one sink per coroutine, so they
  replace the old `-> requests.get` keys for the same two coroutines.
- #87 no-agent-construction gate: the alias walker handled ast.Assign only.
  It now handles AnnAssign too (`store: X = self.session_store`).
- Cluster A (16 rows here, 33 fleet-wide): tests/ci/test_no_new_source_proxy_asserts.py
  is a ratchet. It flags any test function that calls getsource and asserts
  with in/not in. The 116 functions in 84 files that match today are frozen
  in source_proxy_baseline.json. A new one fails, and so does a stale key.
  Opt out on the def line with `# noqa: source-proxy <reason>`.
Kyzcreig pushed a commit that referenced this pull request Sep 28, 2026
…47)

Ruling: keep gating every mapped ref (fail-safe). The awaiting-deploy comment
now says 'Deploy-gated because <reason states a deploy gate | block reason/card
body names deploy tree X>' so over-gating is visible. Marker unchanged.
New test red on base; test_kanban_pr_gate.py 99/99.
Kyzcreig pushed a commit that referenced this pull request Sep 28, 2026
…t_cd88e043) (#1414)

Rows from t_f4ef102c's CSV (row index #i). Each fix has a test that fails on
base fbfcf03/a290767e19 and passes here.

- #47 kanban_survivor: a submodule gitfile (.git/modules/...) whose target is
  missing was refused as a "dead linked worktree stub". Now only a target under
  .git/worktrees/ counts.
- #64 whatsapp adapter: the npm-install remedy interpolated bridge_dir and the
  npm path unquoted. Both are now shlex.quote'd.
- #86 /kanban dashboard: dashboard_link (reads config.yaml) ran on the event
  loop. Now asyncio.to_thread.
- #12/#63 e2e _owns_transcript_driver: an exception in the interrupt-phase turn
  printed {"interrupted": false} with rc 0. It is now captured and returned as
  rc 4 with the error. The marker path in RUN_TOOL is shlex.quote'd.
- #125/#135 sdlc-review SKILL.md and KANBAN_GUIDANCE: the no-delegation path
  now names batch_id "n/a: <reason>", which the coverage gate accepts
  (asserted).
- #10 test_review_policy_none_skips_every_card patched configured_review_policy
  and then asserted the patch. It now drives the real resolver through
  _board_home_kanban_cfg.
- #28 test_async_hint_is_bounded...: release.set() ran after asyncio.run, so the
  default-executor shutdown waited the full 5 s. Call time: 5.06 s -> 0.20 s.
- #62 test_runtime_tree_is_checked_against_a_real_git_checkout: `git init`
  without -b collided when init.defaultBranch=upstream. Now `-b main`.
- #82 no-network-on-loop gate: added requests.patch/delete and
  httpx.put/patch/delete to the sinks. This surfaced gateway/run.py stop and
  _stop_impl reaching requests.delete (camofox close at shutdown). They are
  baselined as pre-existing; the walker names one sink per coroutine, so they
  replace the old `-> requests.get` keys for the same two coroutines.
- #87 no-agent-construction gate: the alias walker handled ast.Assign only.
  It now handles AnnAssign too (`store: X = self.session_store`).
- Cluster A (16 rows here, 33 fleet-wide): tests/ci/test_no_new_source_proxy_asserts.py
  is a ratchet. It flags any test function that calls getsource and asserts
  with in/not in. The 116 functions in 84 files that match today are frozen
  in source_proxy_baseline.json. A new one fails, and so does a stale key.
  Opt out on the def line with `# noqa: source-proxy <reason>`.

Co-authored-by: ang-fleet-workers[bot] <333956806+ang-fleet-workers[bot]@users.noreply.github.com>
Co-authored-by: ang-fleet-interactive[bot] <333962442+ang-fleet-interactive[bot]@users.noreply.github.com>
Kyzcreig pushed a commit that referenced this pull request Sep 28, 2026
…47)

Ruling: keep gating every mapped ref (fail-safe). The awaiting-deploy comment
now says 'Deploy-gated because <reason states a deploy gate | block reason/card
body names deploy tree X>' so over-gating is visible. Marker unchanged.
New test red on base; test_kanban_pr_gate.py 99/99.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant