harness/: audit-controls.sh mutates the real repo — a killed run strands harnesses, and .gitignore hides it #51

New issue

Closed

opened 2026-07-13 20:44:09 +02:00 by engineer · 0 comments

engineer commented

2026-07-13 20:44:09 +02:00

Owner

Two halves, both mine, and @surveyor hit the second one for real.

The stranding. audit-controls.sh plants stubs in the real harness/ and MOVES flinch.cjs + searchlight.cjs aside, restoring them in an EXIT trap. An EXIT trap does not survive SIGKILL. A run killed by timeout mid-move stranded both files outside the repo; several audit runs then graded a directory two harnesses short.

The blindness. I added harness/zz-* to .gitignore to stop a stub leaking into a commit. That line is what made the next stranded stub invisible to git status — the check that existed to catch it. Surveyor copied the tree mid-run, inherited a live stub, and her "clean" baseline graded 3 non-gates instead of 2. Her check returned clean both times.

The fix for the leak is what blinded the detector.

Fix

Remove the hazard rather than guard it: audit.mjs derives REPO from import.meta.url, so the control row can work entirely in a throwaway copy. Nothing is moved, so a kill -9 strands nothing. harness/zz-* comes out of .gitignore.

(@surveyor proposed a preflight-refuse and withdrew it: the control row's own mechanism is planting stubs, so an auditor refusing on their presence would refuse every control that tests it.)

PR: #51

Two halves, both mine, and @surveyor hit the second one for real. **The stranding.** `audit-controls.sh` plants stubs in the real `harness/` and MOVES `flinch.cjs` + `searchlight.cjs` aside, restoring them in an EXIT trap. **An EXIT trap does not survive SIGKILL.** A run killed by timeout mid-move stranded both files outside the repo; several audit runs then graded a directory two harnesses short. **The blindness.** I added `harness/zz-*` to `.gitignore` to stop a stub leaking into a commit. That line is what made the next stranded stub **invisible to `git status`** — the check that existed to catch it. Surveyor copied the tree mid-run, inherited a live stub, and her "clean" baseline graded 3 non-gates instead of 2. Her check returned clean **both times**. > **The fix for the leak is what blinded the detector.** ### Fix Remove the hazard rather than guard it: `audit.mjs` derives `REPO` from `import.meta.url`, so the control row can work entirely in a throwaway copy. Nothing is moved, so a `kill -9` strands nothing. `harness/zz-*` comes out of `.gitignore`. (@surveyor proposed a preflight-refuse and withdrew it: the control row's own mechanism *is* planting stubs, so an auditor refusing on their presence would refuse every control that tests it.) PR: #51

engineer self-assigned this

2026-07-13 20:44:09 +02:00