test: remove brittle diagnostic count assertion from dispatch resolution tests by MrGTV-love · Pull Request #20 · MrGTV-love/firstmate

MrGTV-love · 2026-10-02T05:44:12Z

Intent

"what you should be asking is why is ci red? is it because the code is bad or the test is bad? We can't leave it red and work around it" (2026-09-30). Bad tests are to be fixed, not waived.

Context: the approved lint-memory fix encountered a main-first test prerequisite in tests/fm-dispatch-resolve.test.sh. Its directory-at-list-path case failed in Linux job https://github.com/MrGTV-love/firstmate/actions/runs/36938597844/job/110624590742 because expect_withheld required exactly one nonempty stderr line and observed two. Neither underlying stderr line was logged, so the source of the second line is unknown. The owning report proposes removing the incidental total-line-count assertion while preserving the actual off/default-intake behavior and absence of sensitive output. This is that bounded prerequisite, not the lint-memory implementation or a guessed production-dispatcher fix.

What Changed

Remove the exact stderr line-count assertion from withheld-dispatch tests while retaining checks for the off diagnostic, empty stdout for default intake, and no curl or quota calls.
Strengthen stderr privacy assertions to reject API keys and private brief identifiers across literal-match, inherited-list, directory, and broken-symlink cases.

Risk Assessment

✅ Low: The change is confined to test assertions and implements the approved removal of total stderr counts while retaining withholding behavior checks and explicit sensitive-output coverage.

Testing

The targeted resolver checks passed on macOS and Linux with jq 1.7.1. Eight live withholding scenarios preserved exit 0, empty stdout, the expected off/nothing-sent reason, absence of tested sensitive values, and no observed curl or quota calls; invalid-list boundaries also passed live on Linux. An initial jq 1.6 formatting failure was resolved through disposable dependency setup. Raw CLI evidence was saved and fixtures removed. The historical unlogged second Linux stderr line was not reproduced or attributed.

Live validation: ✅ go - 8 of 8 scenarios driven live against the product

Scenario	Result	Live	Evidence
Private brief is withheld despite case and surrounding whitespace	✅ pass	live	Live resolver artifact, macOS scenario 1: matched list line 3; exit 0, empty stdout, expected off reason, no API/account/private-value leakage or outbound calls.
Private phrase spanning brief lines is withheld	✅ pass	live	Live resolver artifact, macOS scenario 2: wrapped phrase matched list line 1 without exposing the phrase or API-key sentinel.
Private phrase using tab and no-break spaces is withheld	✅ pass	live	Live resolver artifact, macOS scenario 3: whitespace-normalized match returned the expected off/nothing-sent diagnostic and no outbound calls.
Private project name is withheld	✅ pass	live	Live resolver artifact, macOS scenario 4: project-name match withheld dispatch without printing the private project name or API-key sentinel.
Private rule criterion is withheld	✅ pass	live	Live resolver artifact, macOS scenario 5: a phrase present only in the rule criterion triggered withholding without exposing it.
Inherited private list withholds dispatch from a secondmate home	✅ pass	live	Live resolver artifact, macOS scenario 6: real configuration propagation copied the list into a disposable child home; the resolver withheld dispatch without API/account/private-brief leakage.
Directory at the never-send path fails closed without leaking the brief	✅ pass	live	Live resolver artifact, macOS scenario 7 and Linux directory scenario: exit 0, empty stdout, unreadable-regular-file off reason, no tested secrets or curl/quota calls.
Broken symlink at the never-send path fails closed without leaking the brief	✅ pass	live	Live resolver artifact, macOS scenario 8 and Linux symlink scenario: exit 0, empty stdout, unreadable-regular-file off reason, no tested secrets or curl/quota calls.

Evidence: Live resolver withholding output and side-effect observations

Source: Live resolver withholding output and side-effect observations

{
  "scope": "Actual resolver CLI executed with real dependencies and disposable FM_HOME; raw stdout/stderr are retained without filtering or line-count assertions. No production credentials or fleet lifecycle used.",
  "observation": "Separate bash -x invocation checked executed curl and quota-axi commands. Initial BASH_XTRACEFD approach was discarded because stock macOS Bash does not support it.",
  "macOS": [
    {
      "name": "Private brief is withheld despite case and surrounding whitespace",
      "result": "pass",
      "live": true,
      "command": "FM_HOME=<disposable home> TYPESAFE_API_KEY=<disposable sentinel> bin/fm-dispatch-resolve.sh .dispatch-validation/private-brief.md --project pager",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 3; nothing sent)\n",
      "expected_reason": "brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 3",
      "observation_command": "bash -x bin/fm-dispatch-resolve.sh .dispatch-validation/private-brief.md --project pager",
      "observation_exit": 0,
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": []
    },
    {
      "name": "Private phrase spanning brief lines is withheld",
      "result": "pass",
      "live": true,
      "command": "FM_HOME=<disposable home> TYPESAFE_API_KEY=<disposable sentinel> bin/fm-dispatch-resolve.sh .dispatch-validation/wrapped-brief.md --project pager",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 1; nothing sent)\n",
      "expected_reason": "brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 1",
      "observation_command": "bash -x bin/fm-dispatch-resolve.sh .dispatch-validation/wrapped-brief.md --project pager",
      "observation_exit": 0,
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": []
    },
    {
      "name": "Private phrase using tab and no-break spaces is withheld",
      "result": "pass",
      "live": true,
      "command": "FM_HOME=<disposable home> TYPESAFE_API_KEY=<disposable sentinel> bin/fm-dispatch-resolve.sh .dispatch-validation/wrapped-brief.md --project pager",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 1; nothing sent)\n",
      "expected_reason": "brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 1",
      "observation_command": "bash -x bin/fm-dispatch-resolve.sh .dispatch-validation/wrapped-brief.md --project pager",
      "observation_exit": 0,
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": []
    },
    {
      "name": "Private project name is withheld",
      "result": "pass",
      "live": true,
      "command": "FM_HOME=<disposable home> TYPESAFE_API_KEY=<disposable sentinel> bin/fm-dispatch-resolve.sh .dispatch-validation/public-brief.md --project orion-private",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 1; nothing sent)\n",
      "expected_reason": "brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 1",
      "observation_command": "bash -x bin/fm-dispatch-resolve.sh .dispatch-validation/public-brief.md --project orion-private",
      "observation_exit": 0,
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": []
    },
    {
      "name": "Private rule criterion is withheld",
      "result": "pass",
      "live": true,
      "command": "FM_HOME=<disposable home> TYPESAFE_API_KEY=<disposable sentinel> bin/fm-dispatch-resolve.sh .dispatch-validation/public-brief.md --project pager",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 1; nothing sent)\n",
      "expected_reason": "brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send line 1",
      "observation_command": "bash -x bin/fm-dispatch-resolve.sh .dispatch-validation/public-brief.md --project pager",
      "observation_exit": 0,
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": []
    },
    {
      "name": "Inherited private list withholds dispatch from a secondmate home",
      "result": "pass",
      "live": true,
      "command": "FM_HOME=<disposable home> TYPESAFE_API_KEY=<disposable sentinel> bin/fm-dispatch-resolve.sh .dispatch-validation/private-brief.md --project pager",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/secondmate-home/config/dispatch-never-send line 1; nothing sent)\n",
      "expected_reason": "brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/secondmate-home/config/dispatch-never-send line 1",
      "observation_command": "bash -x bin/fm-dispatch-resolve.sh .dispatch-validation/private-brief.md --project pager",
      "observation_exit": 0,
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": []
    },
    {
      "name": "Directory at the never-send path fails closed without leaking the brief",
      "result": "pass",
      "live": true,
      "command": "FM_HOME=<disposable home> TYPESAFE_API_KEY=<disposable sentinel> bin/fm-dispatch-resolve.sh .dispatch-validation/private-brief.md --project pager",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send is not a readable regular file; nothing sent)\n",
      "expected_reason": "~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send is not a readable regular file",
      "observation_command": "bash -x bin/fm-dispatch-resolve.sh .dispatch-validation/private-brief.md --project pager",
      "observation_exit": 0,
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": []
    },
    {
      "name": "Broken symlink at the never-send path fails closed without leaking the brief",
      "result": "pass",
      "live": true,
      "command": "FM_HOME=<disposable home> TYPESAFE_API_KEY=<disposable sentinel> bin/fm-dispatch-resolve.sh .dispatch-validation/private-brief.md --project pager",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send is not a readable regular file; nothing sent)\n",
      "expected_reason": "~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send is not a readable regular file",
      "observation_command": "bash -x bin/fm-dispatch-resolve.sh .dispatch-validation/private-brief.md --project pager",
      "observation_exit": 0,
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": []
    }
  ],
  "Linux": [
    {
      "name": "Directory at the never-send path fails closed without leaking the brief",
      "platform": "Linux, Bash and jq 1.7.1",
      "result": "pass",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send is not a readable regular file; nothing sent)\n",
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": [],
      "network": "disabled for disposable container"
    },
    {
      "name": "Broken symlink at the never-send path fails closed without leaking the brief",
      "platform": "Linux, Bash and jq 1.7.1",
      "result": "pass",
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/primary-home/config/dispatch-never-send is not a readable regular file; nothing sent)\n",
      "curl_or_quota_invocations": [],
      "sensitive_values_observed": [],
      "network": "disabled for disposable container"
    }
  ],
  "historical_failure": "The previously unlogged second Linux stderr line was not reproduced or attributed."
}

Evidence: Targeted macOS and Linux resolver test transcripts

Source: Targeted macOS and Linux resolver test transcripts

TARGETED MACOS TEST
command: TMPDIR=<worktree disposable tmp> bash tests/fm-dispatch-resolve.test.sh
exit: 0
ok - absent key is off: one stderr line, exit 0, no network call
ok - TYPESAFE_API_KEY= in .env activates the tool; environment and config overrides work
ok - clear: one rule Choice request, key on the fd header only, spendPriority argmax over every candidate
ok - stock Bash resolver separates API, quota, local and total timing, with input-only Jev cost
ok - stock Bash timing uses the host epoch clock at millisecond precision
skip: bash on PATH has no EPOCHREALTIME
ok - missing curl transfer time is reported as unknown
ok - unavailable usage is unknown and a failed quota snapshot retains API cost
ok - quota-error model evidence accepts only safe Jev version ids
ok - successful resolution model evidence accepts only safe Jev version ids
ok - error diagnostics omit sensitive API bodies without blocking intake
ok - never-send list withholds the request on a match or a bad list, and never prints the value
ok - rules snapshots and shell quoting preserve the profile protocol
ok - no-rule fallback, Agy, Gemini, and documented configurations resolve
ok - ambiguous: confidence below the fixed floor hands the decision back
ok - per-rule confidence floors fall to the most probable runner-up that clears its own floor
ok - only the brief's task sections and scout tag reach the model, with a whole-brief fallback
ok - escalate: a rule declared approval: captain never yields a profile
ok - rule floor: known shortfall falls through while unavailable evidence escalates
ok - declared provider and profile floor evidence are applied in code
ok - nonnumeric spendPriority evidence is never ranked
ok - partial and missing quota evidence remain eligible but unranked
ok - provider-wide and exact quota rows combine into one limiting candidate
ok - default: no rule matched resolves among the default profiles
ok - tie: equal spendPriority never breaks by array order
ok - no rankable candidate: the tool escalates instead of guessing
ok - native Codex binds to codex-home before default, independently of Pi accounts and row order
ok - Pi native adapters bind to codex-home with existing fallbacks and schema 5 compatibility
ok - schema 6: each candidate binds to its account row; schema 5 is unchanged
ok - task-horizon runway, pooled-account, OpenRouter coverage, and minimum-version guards
ok - quota evidence comes from one quota-axi --json read, and its failure is an error outcome
ok - API, transport, and response failures are error outcomes with exit 0
ok - configuration errors exit 2 before any network call
# all fm-dispatch-resolve tests passed

INITIAL DISPOSABLE LINUX TEST (jq 1.6)
command: docker run --rm --network none --read-only --mount type=bind,source=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB,target=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB --workdir ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB --env TMPDIR=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/tmp --env HOME=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/linux-home --entrypoint bash fm-remote-seed-git255:latest tests/fm-dispatch-resolve.test.sh
exit: 1
ok - absent key is off: one stderr line, exit 0, no network call
ok - TYPESAFE_API_KEY= in .env activates the tool; environment and config overrides work
ok - clear: one rule Choice request, key on the fd header only, spendPriority argmax over every candidate
ok - stock Bash resolver separates API, quota, local and total timing, with input-only Jev cost
ok - stock Bash timing uses the host epoch clock at millisecond precision
ok - EPOCHREALTIME timing stays on the builtin fast path
ok - missing curl transfer time is reported as unknown
ok - unavailable usage is unknown and a failed quota snapshot retains API cost
ok - quota-error model evidence accepts only safe Jev version ids
ok - successful resolution model evidence accepts only safe Jev version ids
ok - error diagnostics omit sensitive API bodies without blocking intake
ok - never-send list withholds the request on a match or a bad list, and never prints the value
ok - rules snapshots and shell quoting preserve the profile protocol
ok - no-rule fallback, Agy, Gemini, and documented configurations resolve
ok - ambiguous: confidence below the fixed floor hands the decision back
not ok - the runner-up clears the same floor it would need as the pick (missing: '  fallback: rule_4 (A simple bug fix with a stated root cause.) probability 0.30 clears its floor 0.3; rule_2 probability 0.55 is below its floor 0.9')
--- output ---
dispatch-resolve:
  status: clear
  model: jev-1.13.0   latency_ms: 0   tokens: 812/60
  rule: rule_2 (The task generates images.)   confidence: 0.95
  probabilities: rule_1=0.05 rule_2=0.55 rule_3=0.05 rule_4=0.3 default=0.05
  fallback: rule_4 (A simple bug fix with a stated root cause.) probability 0.3 clears its floor 0.3; rule_2 probability 0.55 is below its floor 0.9
  note: rule matched
  note: 1 eligible candidate(s) unranked (kimi)
  candidate: claude:sonnet  provider=claude  scope=all_models  remaining=79%  spendPriority=-0.4627  runway=projected_exhaustion  -> eligible [warning: projected_exhaustion at all_models (usableRunwaySeconds=unknown projectionConfidence=unknown)]
  candidate: cursor:cursor-grok-4.6-medium  provider=cursor  scope=all_models  remaining=91%  spendPriority=0.7597  runway=through_reset  -> eligible
  candidate: kimi:kimi-code/k3  provider=kimi  -> eligible, unranked: provider kimi unmeasured (unknown): disclosed uncertainty
  profile: --harness 'cursor' --model 'cursor-grok-4.6-medium'
  timings: api_ms=0 quota_ms=5 local_ms=358 total_ms=363
  usage: input_tokens=812 output_tokens=60 jev_cost_usd=3.4104e-05 jev_input_usd_per_million=0.042 returned_model=jev-1.13.0

DISPOSABLE LINUX TEST (workspace-local jq 1.7.1)
command: docker run --rm --network none --read-only --mount type=bind,source=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB,target=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB --workdir ~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB --env TMPDIR=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/tmp --env HOME=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/linux-home --env PATH=~/.no-mistakes/worktrees/32d18ed9638d/01M4919CAQHJ5E6TXXT20PMCEB/.dispatch-validation/linux-tools:/usr/local/bin:/usr/bin:/bin --entrypoint bash fm-remote-seed-git255:latest tests/fm-dispatch-resolve.test.sh
exit: 0
ok - absent key is off: one stderr line, exit 0, no network call
ok - TYPESAFE_API_KEY= in .env activates the tool; environment and config overrides work
ok - clear: one rule Choice request, key on the fd header only, spendPriority argmax over every candidate
ok - stock Bash resolver separates API, quota, local and total timing, with input-only Jev cost
ok - stock Bash timing uses the host epoch clock at millisecond precision
ok - EPOCHREALTIME timing stays on the builtin fast path
ok - missing curl transfer time is reported as unknown
ok - unavailable usage is unknown and a failed quota snapshot retains API cost
ok - quota-error model evidence accepts only safe Jev version ids
ok - successful resolution model evidence accepts only safe Jev version ids
ok - error diagnostics omit sensitive API bodies without blocking intake
ok - never-send list withholds the request on a match or a bad list, and never prints the value
ok - rules snapshots and shell quoting preserve the profile protocol
ok - no-rule fallback, Agy, Gemini, and documented configurations resolve
ok - ambiguous: confidence below the fixed floor hands the decision back
ok - per-rule confidence floors fall to the most probable runner-up that clears its own floor
ok - only the brief's task sections and scout tag reach the model, with a whole-brief fallback
ok - escalate: a rule declared approval: captain never yields a profile
ok - rule floor: known shortfall falls through while unavailable evidence escalates
ok - declared provider and profile floor evidence are applied in code
ok - nonnumeric spendPriority evidence is never ranked
ok - partial and missing quota evidence remain eligible but unranked
ok - provider-wide and exact quota rows combine into one limiting candidate
ok - default: no rule matched resolves among the default profiles
ok - tie: equal spendPriority never breaks by array order
ok - no rankable candidate: the tool escalates instead of guessing
ok - native Codex binds to codex-home before default, independently of Pi accounts and row order
ok - Pi native adapters bind to codex-home with existing fallbacks and schema 5 compatibility
ok - schema 6: each candidate binds to its account row; schema 5 is unchanged
ok - task-horizon runway, pooled-account, OpenRouter coverage, and minimum-version guards
ok - quota evidence comes from one quota-axi --json read, and its failure is an error outcome
ok - API, transport, and response failures are error outcomes with exit 0
ok - configuration errors exit 2 before any network call
# all fm-dispatch-resolve tests passed

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

Live validation: ✅ go - 8 of 8 scenarios driven live against the product

Scenario	Result	Live	Evidence
Private brief is withheld despite case and surrounding whitespace	✅ pass	live	Live resolver artifact, macOS scenario 1: matched list line 3; exit 0, empty stdout, expected off reason, no API/account/private-value leakage or outbound calls.
Private phrase spanning brief lines is withheld	✅ pass	live	Live resolver artifact, macOS scenario 2: wrapped phrase matched list line 1 without exposing the phrase or API-key sentinel.
Private phrase using tab and no-break spaces is withheld	✅ pass	live	Live resolver artifact, macOS scenario 3: whitespace-normalized match returned the expected off/nothing-sent diagnostic and no outbound calls.
Private project name is withheld	✅ pass	live	Live resolver artifact, macOS scenario 4: project-name match withheld dispatch without printing the private project name or API-key sentinel.
Private rule criterion is withheld	✅ pass	live	Live resolver artifact, macOS scenario 5: a phrase present only in the rule criterion triggered withholding without exposing it.
Inherited private list withholds dispatch from a secondmate home	✅ pass	live	Live resolver artifact, macOS scenario 6: real configuration propagation copied the list into a disposable child home; the resolver withheld dispatch without API/account/private-brief leakage.
Directory at the never-send path fails closed without leaking the brief	✅ pass	live	Live resolver artifact, macOS scenario 7 and Linux directory scenario: exit 0, empty stdout, unreadable-regular-file off reason, no tested secrets or curl/quota calls.
Broken symlink at the never-send path fails closed without leaking the brief	✅ pass	live	Live resolver artifact, macOS scenario 8 and Linux symlink scenario: exit 0, empty stdout, unreadable-regular-file off reason, no tested secrets or curl/quota calls.

TMPDIR=<worktree disposable tmp> bash tests/fm-dispatch-resolve.test.sh — passed on macOS.
Executed bin/fm-dispatch-resolve.sh <brief> --project <name> with disposable FM_HOME directories and a synthetic API-key sentinel for eight withholding scenarios.
Repeated each live scenario with bash -x bin/fm-dispatch-resolve.sh ... to observe executed commands; no curl or quota-axi invocations occurred. Normal invocations retained unfiltered stdout and stderr.
Ran the targeted resolver test file in a disposable, network-disabled, read-only Linux container. The initial jq 1.6 run failed on an unrelated decimal-format assertion; the run passed after supplying workspace-local jq 1.7.1.
Executed the real resolver’s directory-at-list-path and broken-symlink scenarios in the isolated Linux container; both passed.
Saved CLI and targeted-test transcripts in the evidence directory, then removed disposable homes, briefs, temporary files, and the downloaded jq binary.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

…stic-count-main

MrGTV-love added 3 commits October 1, 2026 23:37

test: preserve dispatch withholding invariants without stderr count

fa2e0be

no-mistakes(review): test: check API key and account in withheld cases

25c0723

Merge remote-tracking branch 'origin/main' into fm/fm-dispatch-diagno…

625c4e4

…stic-count-main

MrGTV-love changed the title ~~test: drop the stderr line-count check from dispatch withholding cases~~ test: remove brittle diagnostic count assertion from dispatch resolution tests Oct 6, 2026

MrGTV-love merged commit d920543 into main Oct 6, 2026
22 of 23 checks passed

MrGTV-love mentioned this pull request Oct 11, 2026

fix(bin): merge upstream main through fb75c1f9 and record the squashed #43 sync as merged #104

Merged

Navigation Menu

Repository navigation

test: remove brittle diagnostic count assertion from dispatch resolution tests - #20

test: remove brittle diagnostic count assertion from dispatch resolution tests#20
MrGTV-love merged 3 commits into
mainfrom
fm/fm-dispatch-diagnostic-count-main

MrGTV-love commented Oct 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

MrGTV-love commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Intent

What Changed

Risk Assessment

Testing

Pipeline

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

MrGTV-love commented Oct 2, 2026 •

edited

Loading