Lucent-Financial-Group · AceHack · May 3, 2026 · May 3, 2026
diff --git a/memory/MEMORY.md b/memory/MEMORY.md
@@ -4,6 +4,7 @@
 <!-- paired-edit log (NOT the single-slot latest-marker — that lives on line 3 above): PR #986 lands carved-sentence fixed-point stability + Zeta soul-file executor architecture (Infer.NET-style Bayesian inference, NOT LLMs) + carved sentences ≈ formal specs provable in DST + Deepseek CSAP review absorption (Aaron 2026-04-30 → 2026-05-01, eight-message chain across two autonomous-loop ticks per the file body's section header). Architectural disclosure: substrate IS the priors; alignment IS substrate. The single-slot latest-marker on line 3 (forever-home Aaron 2026-05-01) takes precedence as the chronologically-latest paired edit; this PR's work is earlier. -->
 **📌 Fast path: read `CURRENT-aaron.md` and `CURRENT-amara.md` first.** <!-- paired-edit: PR #690 scheduled-workflow-null-result-hygiene-scan tier-1 promotion 2026-04-28 --> These per-maintainer distillations show what's currently in force. Raw memories below are the history; CURRENT files are the projection. (`CURRENT-aaron.md` refreshed 2026-04-28 with sections 26-30 — speculation rule + EVIDENCE-BASED labeling + JVM preference + dependency honesty + threading lineage Albahari/Toub/Fowler + TypeScript/Bun-default discipline.)
 
+- [**Action SHA hallucination — check repo first before pinning (2026-05-03)**](feedback_action_sha_hallucination_check_repo_first_aaron_2026_05_03.md) — PR #1417 stryker-mutation.yml pinned a hallucinated SHA for actions/upload-artifact (claimed v5.1.0 but doesn't resolve); every workflow run failed at Set-up-job. Discipline: grep repo first for existing authoritative pins (scorecard.yml had real v7.0.1 SHA); WebSearch upstream releases second; never generate a SHA from training data. SHA + version pair must come from one lookup; generating both from training guarantees inconsistency.
 - [**Under-specified action preconditions — recurring class across formal-spec tools (B-0181 TLA+ + B-0184 Alloy 2026-05-03)**](feedback_under_specified_action_preconditions_recurring_class_in_formal_specs_aaron_2026_05_03.md) — Same author-time class manifested across two formal-verification tools: B-0184 Alloy `Spine.als` (`check`-vs-`run` semantics + missing batch-size `fact`) and B-0181 TLA+ `SpineMergeInvariants.tla` (`Cascade(i)` missing downstream-room precondition). Discipline: audit every state-transition action / `pred` / lemma for neighboring-state preconditions before declaring done; counterexamples showing "obviously-wrong" action sequences usually mean spec-gap, not bug-found.
 - [**PR-review meta-classes — pre-push discipline + sibling-pattern audit + comment-claim verification + exit-code orthogonality + failure-DX + strong-typing (Aaron 2026-05-03)**](feedback_pr_review_meta_classes_pre_push_discipline_aaron_2026_05_03.md) — Six author-time disciplines extracted from #1412/#1413 review cycles. Aaron 2026-05-03 *"any classes to learn to code better next time via meta learning at PR?"* + *"we want to be strongly typed to a large degree"*. Apply at author-time next time; each review thread is a meta-class to internalize, not just a fix to land.
 - [**actions/cache paths mutually exclusive with git ls-files — silent-clobber bug class (Aaron 2026-05-03 "make it not lucky next time")**](feedback_actions_cache_paths_mutually_exclusive_with_git_ls_files_silent_clobber_class_aaron_2026_05_03.md) — Cache hit OVERWRITES checked-out source content; PR edits silently revert; CI tests OLD content but reports as PR's new state. Surfaced via CircuitRegistration B-0180 fix passing locally + failing CI. Carved-sentence rule + `audit-ci-cache-paths.ts` + CI lint gate prevent recurrence.

diff --git a/memory/feedback_action_sha_hallucination_check_repo_first_aaron_2026_05_03.md b/memory/feedback_action_sha_hallucination_check_repo_first_aaron_2026_05_03.md
@@ -0,0 +1,85 @@
+---
+name: action SHA hallucination — check repo first before pinning
+description: Author-time discipline: never invent an actions/SHA pair from training data; grep the repo for an existing authoritative pin
+type: feedback
+---
+
+# Action-SHA hallucination is a real failure class
+
+## What happened
+
+When authoring `.github/workflows/stryker-mutation.yml` (PR #1417),
+I pinned `actions/upload-artifact@9eaf0eba75d52b5e72c7a193fc2887e6caf95df0`
+with the comment `# v5.1.0`. The SHA was hallucinated — it doesn't
+resolve to any actual git object in `actions/upload-artifact`. The
+version number was also wrong (the current major is v7, not v5).
+
+Every workflow run after #1417 merged failed at the `Set up job`
+step with `Unable to resolve action actions/upload-artifact@9eaf0eba...`.
+Surfaced empirically on #1420's CI run (databaseId 25283000236).
+
+## Why: training-data weights generate plausible-shaped SHAs
+
+A 40-character hex string IS the shape of a git SHA. Training-data
+patterns include lots of action SHAs from various Anthropic-trained
+example workflows. When asked to pin an action SHA, the model
+generates something SHA-shaped that LOOKS authoritative — but
+generates from training-distribution rather than from any actual
+upstream reality.
+
+The version-number comment (`# v5.1.0`) makes this worse: a real
+SHA + version pair is internally consistent only if both come from
+the same upstream lookup. Generating both from training data
+guarantees they're inconsistent — the model picks a plausible SHA
+AND a plausible version, neither of which actually corresponds to
+the real release map.
+
+## How to apply: search-repo-first as primary authority
+
+Author-time discipline for any `uses: <action>@<SHA> # <version>`
+pin in a workflow file:
+
+1. **Grep the repo first.** `grep -rn "<action>@" .github/workflows/`
+   — if the action is already pinned somewhere, that pin is
+   authoritative-by-use (it's been working in CI). Copy the SHA +
+   version verbatim.
+2. **If not in repo, WebSearch the upstream releases page.** Per
+   Otto-364 search-first-authority. Get the SHA from
+   `https://github.com/<owner>/<action>/releases/tag/<version>`
+   directly.
+3. **Never generate a SHA from training data.** A SHA-shaped string
+   that LOOKS plausible is not the same as a SHA that resolves.
+   Training data is historical truth at best; for action SHAs
+   specifically, the values are version-tagged immutable refs that
+   the model never has authoritative knowledge of.
+4. **Cross-check the version-number comment.** If the major version
+   in the comment doesn't match the current upstream major, that's
+   a strong signal the pair was generated, not looked up.
+
+## Composes with
+
+- **Otto-364 search-first-authority** — generalized rule that
+  load-bearing claims about tools / standards / APIs need current
+  upstream verification, not training-data defaults. SHA pinning is
+  one specific instance of the broader class.
+- **Otto-247 version-currency-always-search-first** — narrower
+  predecessor specifically for version numbers; this rule extends
+  to the SHA<->version pair.
+- **PR-review meta-classes memory** (2026-05-03) — sibling-pattern
+  audit before authoring is the equivalent author-time discipline
+  for code patterns. The action-SHA discipline is the same shape
+  applied to workflow pins.
+
+## Discriminating signal
+
+When the very first CI run on a new workflow fails at "Set up job"
+with `Unable to resolve action`, the failure class is action-SHA
+hallucination. Real CI infrastructure failures (network, runner
+allocation, etc.) fail with different error patterns. Resolution-
+time errors specifically point at SHA + version mismatch.
+
+## Carved sentence
+
+*"A SHA-shaped string from training data is not a SHA. Verify
+against the repo first, the upstream releases page second, never
+the training prior."*