test(admission): restore the dropped commitments assertion — as the one it was protecting - #67
Conversation
…ne it was protecting
`capability_admission._selftest` computed `cited = {d["record"] for d in
com["dangling_citations"]}` and asserted nothing on it, under a section header claiming "the real
historical failure must be detected, not hypothetically detectable" and a comment saying the
assertion "must never be quietly dropped". A value computed for a check that no longer checks is
this repo's founding defect in miniature, so the binding was right to go — but the header's claim
went unenforced with it.
WHAT THE ASSERTION SHOULD BE. Not the one that was there. Two findings settle it:
* `assert "2026-07-15-range-lane-trial-review.md" in cited` cannot be restored: the record has
since been WRITTEN, so the live dangling set is empty wherever the ledger exists. This is
exactly the "if someone fixes that line" branch the old comment anticipated.
* `assert not cited` is not worth restoring either: `test_dated_promises_left_an_artifact` already
asserts the strongest available claim on the live set — that BOTH lists are empty. A weaker copy
in the selftest adds nothing.
...and the synthetic-file check below it is NOT sufficient, which is the real hole.
`_probe_commitments` always passes an explicit `root=`, so NOTHING in the suite exercises
`root or HERE`. A default that stopped resolving to the checkout returns `clean: True` over ZERO
files — and the selftest's `isinstance(com["clean"], bool)` and the pytest emptiness assertion BOTH
stay green on a scan that examined nothing. That is verify.py's vacuous zero-exit one level up.
So `_probe_live_root` asserts what the binding was reaching for, on the real tree, off the same
synthetic-empty-`AUDITS` harness that already makes `_probe_commitments` machine-independent (with
no records in existence, every dated citation dangles, so the verdict is identical on the owner's
machine and a bare runner):
* NON-VACUITY — the default-root scan must surface the tree's own dated citations (4 today:
CLAUDE.md, README.md, completion_event_adapter.py, and orchestrate.sh:109, the motivating line).
* PROVENANCE — each report's file:line must actually contain the record it names. The probe only
ever checks `record`, so a right-record/wrong-line report passes it, and "go look here" is this
gate's entire output.
* THE SKIP — this file must never appear in its own report. It cites two dated records in its own
docstring because it documents the detector; a finding clearable only by deleting that
documentation is a permanently-red gate, and a permanently-red gate gets switched off.
* NO LEDGER, NO VERDICT — the fail-open branch must return "nothing found", never a verdict it
could not compute. Pointed at a nonexistent path so it runs on the ledger machine too.
DELIBERATE-BREAK -> REVERT, all four reverted clean:
1. `root or HERE` -> `root or (HERE / "config")`: non-vacuity fires. Under the SAME break,
`_probe_commitments` PASSES and `test_dated_promises_left_an_artifact` PASSES (1 passed) —
which is the proof the hole was real and unguarded.
2. `enumerate(splitlines(), 1)` -> `, 0)`: provenance fires, naming CLAUDE.md:143.
3. `SKIP_NAMES` emptied: the self-report check fires. FIRST DRAFT DID NOT — it asserted
`not reported & SKIP_NAMES`, comparing the report against the very set whose failure it was
meant to catch, so emptying the set made it vacuously true. Caught only by the break test, and
rewritten as a literal. Worth recording: the first attempt at the fix reproduced the defect.
4. the `skipped` key removed from the no-ledger return: the fail-open check fires.
Dedup (CLAUDE.md 0), recorded in the `capability-admission-gate` ledger notes: grepped by concept
for scan-reaches-the-tree / vacuity / provenance coverage. The only three things that assert on
`commitments()` are `_probe_commitments` (synthetic root), the selftest shape check, and the pytest
emptiness test. Not present; extended the existing gate rather than adding one. No new capability,
no rail/role change, so ARCHITECTURE.md and the diagram are unaffected.
Verified with `python3 verify.py`: 387 passed, 0 failed, 0/26 skipped, 83/83 selftests, 43/43
can-fire, 5/5 gates, commitments clean. Floor and ceilings untouched — no new pytest test and no new
skip, so nothing moved. Adds 0.13s to the selftest. `ruff check --select E4,E7,E9,F` and
`black --check --line-length 100` clean, so this does not re-introduce the F841 that removed the
binding.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 18 minutes Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
Comment |
GitHub Actions
Inactive
Automated Status SummaryHead SHA: d04b554
Coverage Overview
Coverage Trend
Top Coverage Hotspots (lowest coverage)
Low Coverage Files (<50.0%)
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
|
Runner dispatch state for codex on PR #67. Do not edit. |
|
Runner dispatch state for autofix on PR #67. Do not edit. |
|
Workflow state fingerprint for Agents Gate Followups. Do not edit. |
|
Workflow state fingerprint for Keepalive Loop Reporter. Do not edit. |
CI red here is #60's blocker, not this PR — do not fix it hereAll five failing jobs ( That file is absent from this branch and from #60 is already the fix ( Verified: this PR is green once #60 landsNon-destructive test merge of this branch against #60's branch — no conflict, even though both So Merge orderEither order works since the merge is clean, but #60 first is preferable: this PR then arrives on a 🤖 Addressed by Claude Code |
Brings in #60 (`autofix-versions.env`, `ruff.toml`, `mypy.ini`, the tree drain), which is what every red check on this PR was actually waiting for — all five python-ci jobs were dying at the shared install step before any tool ran. `capability_admission.py` auto-merged: #60 deletes the bare `cited` binding, this branch deletes it and adds `_probe_live_root` in its place, so the two agree on the deletion and differ only in what replaces it. Verified afterwards that the only remaining `cited = {d["record"]...}` in the file is the docstring quoting it as the thing that was dropped. ONE conflict, `langsmith-fleet-worker-attempt.json` (add/add): a generated worker-attempt telemetry snapshot that each CI run rewrites. Resolved to main's copy verbatim, so this PR's diff against main stays exactly one file. It is a single-object "last attempt" snapshot rather than a log, so taking either side discards the other by design — not something to repair in a merge. Net change vs main after the merge: capability_admission.py only, +84/-4. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
Conflict resolved,
|
…ssertion branch One conflict, in `capability_admission.py`: the selftest's closing summary. #68 added "per-requirement cutoffs are in the past" and "findability is declarable pre-build"; this branch added "live-tree scan proven non-vacuous and correctly attributed". Resolved as the UNION rather than by taking a side — both sides' assertion code is present in the merge, so dropping either claim would make the summary understate what the selftest proves. Verified by RUNNING it rather than by reading: `python3 capability_admission.py --selftest` prints all six claims and exits 0. `.verify-floor.json` did not conflict and needs no edit — the merge result collects 407, exactly the floor main already records, because this branch restores an assertion inside an existing selftest rather than adding a collected test. Ruff and black -l 100 clean across all 196 files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
1 participant
Workflow Source
Started from:
Automation intent:
Notes:
Follow-up to the ruff pass in
claude/ci-conform-format-lint(14ccb6d), which correctly removed adead binding but deliberately left the missing assertion uninvented. This is that assertion.
Summary
capability_admission._selftestcomputedand asserted nothing on it — under a section header claiming "the real historical failure must be
detected, not hypothetically detectable" and a comment saying the assertion "must never be quietly
dropped". A value computed for a check that no longer checks is this repo's founding defect in
miniature, so the binding was right to go; but the header's claim went unenforced with it.
What the assertion should be — not the one that was there
Two findings settle it:
assert "2026-07-15-range-lane-trial-review.md" in citedcannot be restored. That record hassince been written, so the live dangling set is empty wherever the audit ledger exists. This is
exactly the "if someone fixes that line" branch the old comment anticipated.
assert not citedis not worth restoring.test_dated_promises_left_an_artifactalreadyasserts the strongest available claim on the live set — that both lists are empty. A weaker copy
in the selftest adds nothing.
…and the synthetic-file check below it is not sufficient
That is the real hole.
_probe_commitmentsalways passes an explicitroot=, so nothing in thesuite exercises
root or HERE. A default that stopped resolving to the checkout — modulerelocated,
SCAN_SUFFIXESnarrowed,SKIP_NAMESwidened,iterdirover the wrong directory —returns
clean: Trueover zero files, and both the selftest'sisinstance(com["clean"], bool)and the pytest emptiness assertion stay green. That is
verify.py's vacuous zero-exit one level up:the check runs, reads green, and looks at nothing.
The change
New
_probe_live_root, called from the same synthetic-empty-AUDITSharness that already makes_probe_commitmentsmachine-independent (with no records in existence every dated citation dangles,so the verdict is identical on the owner's machine and on a bare CI runner):
CLAUDE.md,README.md,completion_event_adapter.py, andorchestrate.sh:109, the motivating linefile:linemust actually contain the record it names. The probe only ever checksrecord, so a right-record/wrong-line report passes it — and "go look here" is this gate's entire outputTesting
python3 verify.py(not a per-file loop): 387 passed, 0 failed, 0/26 skipped, 83/83 selftests,43/43 can-fire, 5/5 gates, commitments clean.
Floor and ceilings untouched — no new pytest test and no new skip, so nothing moved.
ruff check --select E4,E7,E9,Fandblack --check --line-length 100clean, so this does notre-introduce the F841 that removed the binding. Adds 0.13s to the selftest.
Deliberate-break → revert, all four reverted clean
root or HERE→root or (HERE / "config")— non-vacuity fires. Under the same break,_probe_commitmentspasses andtest_dated_promises_left_an_artifactpasses (1 passed) —that is the proof the hole was real and unguarded.
enumerate(splitlines(), 1)→, 0)— provenance fires, namingCLAUDE.md:143.SKIP_NAMESemptied — the self-report check fires. The first draft did not. It assertednot reported & SKIP_NAMES, comparing the report against the very set whose failure it was meantto catch, so emptying the set made it vacuously true. Caught only by the break test, and rewritten
as a literal. Recorded in the comment: the first attempt at the fix reproduced the defect.
skippedkey removed from the no-ledger return — the fail-open check fires.For the reviewer
capability-admission-gateledger notes rather than onlyhere: grepped by concept for scan-reaches-the-tree / vacuity / provenance coverage. The only three
things that assert on
commitments()are_probe_commitments(synthetic root), the selftest shapecheck, and the pytest emptiness test. Not present; extended the existing gate rather than adding
one. No new capability and no rail/role change, so
ARCHITECTURE.mdand the diagram are unaffected.this holds in a CI checkout. Should the tree ever legitimately stop citing dated records, the live
check has genuinely become vacuous and the assertion fails loudly saying so — that is the intended
failure, not a false alarm.
claude/ci-conform-format-lint(14ccb6d). This branch is cut fromaf6654d, so thecitedline still existed here; both sides remove it.agent's change and the dispatcher — run
orch-sync-mirror.shonly after this merges.🤖 Generated with Claude Code