diff --git a/memory/MEMORY.md b/memory/MEMORY.md index f4cb41e48..262212190 100644 --- a/memory/MEMORY.md +++ b/memory/MEMORY.md @@ -4,6 +4,7 @@ **📌 Fast path: read `CURRENT-aaron.md` and `CURRENT-amara.md` first.** These per-maintainer distillations show what's currently in force. Raw memories below are the history; CURRENT files are the projection. (`CURRENT-aaron.md` refreshed 2026-04-28 with sections 26-30 — speculation rule + EVIDENCE-BASED labeling + JVM preference + dependency honesty + threading lineage Albahari/Toub/Fowler + TypeScript/Bun-default discipline.) +- [**Action SHA hallucination — check repo first before pinning (2026-05-03)**](feedback_action_sha_hallucination_check_repo_first_aaron_2026_05_03.md) — PR #1417 stryker-mutation.yml pinned a hallucinated SHA for actions/upload-artifact (claimed v5.1.0 but doesn't resolve); every workflow run failed at Set-up-job. Discipline: grep repo first for existing authoritative pins (scorecard.yml had real v7.0.1 SHA); WebSearch upstream releases second; never generate a SHA from training data. SHA + version pair must come from one lookup; generating both from training guarantees inconsistency. - [**Under-specified action preconditions — recurring class across formal-spec tools (B-0181 TLA+ + B-0184 Alloy 2026-05-03)**](feedback_under_specified_action_preconditions_recurring_class_in_formal_specs_aaron_2026_05_03.md) — Same author-time class manifested across two formal-verification tools: B-0184 Alloy `Spine.als` (`check`-vs-`run` semantics + missing batch-size `fact`) and B-0181 TLA+ `SpineMergeInvariants.tla` (`Cascade(i)` missing downstream-room precondition). Discipline: audit every state-transition action / `pred` / lemma for neighboring-state preconditions before declaring done; counterexamples showing "obviously-wrong" action sequences usually mean spec-gap, not bug-found. - [**PR-review meta-classes — pre-push discipline + sibling-pattern audit + comment-claim verification + exit-code orthogonality + failure-DX + strong-typing (Aaron 2026-05-03)**](feedback_pr_review_meta_classes_pre_push_discipline_aaron_2026_05_03.md) — Six author-time disciplines extracted from #1412/#1413 review cycles. Aaron 2026-05-03 *"any classes to learn to code better next time via meta learning at PR?"* + *"we want to be strongly typed to a large degree"*. Apply at author-time next time; each review thread is a meta-class to internalize, not just a fix to land. - [**actions/cache paths mutually exclusive with git ls-files — silent-clobber bug class (Aaron 2026-05-03 "make it not lucky next time")**](feedback_actions_cache_paths_mutually_exclusive_with_git_ls_files_silent_clobber_class_aaron_2026_05_03.md) — Cache hit OVERWRITES checked-out source content; PR edits silently revert; CI tests OLD content but reports as PR's new state. Surfaced via CircuitRegistration B-0180 fix passing locally + failing CI. Carved-sentence rule + `audit-ci-cache-paths.ts` + CI lint gate prevent recurrence. diff --git a/memory/feedback_action_sha_hallucination_check_repo_first_aaron_2026_05_03.md b/memory/feedback_action_sha_hallucination_check_repo_first_aaron_2026_05_03.md new file mode 100644 index 000000000..5e9408396 --- /dev/null +++ b/memory/feedback_action_sha_hallucination_check_repo_first_aaron_2026_05_03.md @@ -0,0 +1,85 @@ +--- +name: action SHA hallucination — check repo first before pinning +description: Author-time discipline: never invent an actions/SHA pair from training data; grep the repo for an existing authoritative pin +type: feedback +--- + +# Action-SHA hallucination is a real failure class + +## What happened + +When authoring `.github/workflows/stryker-mutation.yml` (PR #1417), +I pinned `actions/upload-artifact@9eaf0eba75d52b5e72c7a193fc2887e6caf95df0` +with the comment `# v5.1.0`. The SHA was hallucinated — it doesn't +resolve to any actual git object in `actions/upload-artifact`. The +version number was also wrong (the current major is v7, not v5). + +Every workflow run after #1417 merged failed at the `Set up job` +step with `Unable to resolve action actions/upload-artifact@9eaf0eba...`. +Surfaced empirically on #1420's CI run (databaseId 25283000236). + +## Why: training-data weights generate plausible-shaped SHAs + +A 40-character hex string IS the shape of a git SHA. Training-data +patterns include lots of action SHAs from various Anthropic-trained +example workflows. When asked to pin an action SHA, the model +generates something SHA-shaped that LOOKS authoritative — but +generates from training-distribution rather than from any actual +upstream reality. + +The version-number comment (`# v5.1.0`) makes this worse: a real +SHA + version pair is internally consistent only if both come from +the same upstream lookup. Generating both from training data +guarantees they're inconsistent — the model picks a plausible SHA +AND a plausible version, neither of which actually corresponds to +the real release map. + +## How to apply: search-repo-first as primary authority + +Author-time discipline for any `uses: @ # ` +pin in a workflow file: + +1. **Grep the repo first.** `grep -rn "@" .github/workflows/` + — if the action is already pinned somewhere, that pin is + authoritative-by-use (it's been working in CI). Copy the SHA + + version verbatim. +2. **If not in repo, WebSearch the upstream releases page.** Per + Otto-364 search-first-authority. Get the SHA from + `https://github.com///releases/tag/` + directly. +3. **Never generate a SHA from training data.** A SHA-shaped string + that LOOKS plausible is not the same as a SHA that resolves. + Training data is historical truth at best; for action SHAs + specifically, the values are version-tagged immutable refs that + the model never has authoritative knowledge of. +4. **Cross-check the version-number comment.** If the major version + in the comment doesn't match the current upstream major, that's + a strong signal the pair was generated, not looked up. + +## Composes with + +- **Otto-364 search-first-authority** — generalized rule that + load-bearing claims about tools / standards / APIs need current + upstream verification, not training-data defaults. SHA pinning is + one specific instance of the broader class. +- **Otto-247 version-currency-always-search-first** — narrower + predecessor specifically for version numbers; this rule extends + to the SHA<->version pair. +- **PR-review meta-classes memory** (2026-05-03) — sibling-pattern + audit before authoring is the equivalent author-time discipline + for code patterns. The action-SHA discipline is the same shape + applied to workflow pins. + +## Discriminating signal + +When the very first CI run on a new workflow fails at "Set up job" +with `Unable to resolve action`, the failure class is action-SHA +hallucination. Real CI infrastructure failures (network, runner +allocation, etc.) fail with different error patterns. Resolution- +time errors specifically point at SHA + version mismatch. + +## Carved sentence + +*"A SHA-shaped string from training data is not a SHA. Verify +against the repo first, the upstream releases page second, never +the training prior."*