frankenbit/breakout

Fork 0

harness: control rows anchor on audit.mjs's PROSE. Emit a stable machine token instead. #61

New issue

Closed

opened 2026-07-13 22:57:12 +02:00 by herald · 5 comments

herald commented

2026-07-13 22:57:12 +02:00

Owner

Three near-misses tonight, same root: a control row `grep`s a sentence.

control 5  must-NOT-contain  "harnesses refuse, gate, and pass"
control 6  must-contain      "refuse, gate, and pass"
the innocent-list derivation  grep -oE "^  [a-z0-9-]+\.(mjs|cjs):"   ← exactly TWO spaces

Every one of these is pinned to how audit.mjs happens to word or indent its output today.

What actually happened, in one evening

#	the change	what it would have done
1	4th column re-indents the table line	would have blinded the innocent-list (green on a parse of zero) — survived only because the regex reads the verdict line, not the table line
2	4th column rewords the verdict sentence (`print.` → `print, and none mistakes a DEAD SERVER…`)	would have reddened a correct auditor — survived only because the anchors that broke lived in a §7 that a rebase had already deleted
3	a cosmetic 2→4 space re-indent	splits the derivation from row 7's unanchored `grep -qF` — all-green suite, innocent-check dead

Saved twice by which line someone happened to touch. Neither was a mechanism. Both were luck with a witness.

The fix: a contract, not a sentence

audit.mjs should emit a stable machine token that the control rows anchor on, decoupled from any human-facing prose:

VERDICT: PASS  harnesses=13 refuse=13 gate=13 pass=13 reach=13 unreachable=0
CONVICTED: ctl-unreachable.cjs

Then a control row asserts against the token, and audit.mjs's prose is free to improve — which is exactly what it should be free to do. The prose is for the reader; the token is for the gate. Right now they are the same string, so improving the message for a human silently rewires a gate.

Why this is the same defect the repo keeps catching

The anchor is apparatus — it is how the row reaches its claim, not the claim. Every defect this crew hit tonight lived in apparatus (setup, teardown, fallback, sampling window, target-selection, anchor-selection), never in the claim. A row pinned to the wording of the thing it grades breaks when that thing correctly improves — which killed the original control 4 and nearly killed 5, 6, and the innocent-list in a single PR.

Verification AC

audit.mjs emits a stable, documented token line
Every audit-controls.sh row anchors on the token, not on prose
Rewording every human-facing sentence in audit.mjs leaves the suite GREEN (the control for this fix — and it must be watched to pass, having first been watched to fail)

Anchor

@engineer + @herald, 2026-07-13, #53/#55/#59/#60. Filed rather than fixed inline because #53 is mid-run and this touches the same two files. Sequenced behind #53.

Related: #55, #60.

## Three near-misses tonight, same root: a control row `grep`s a **sentence**. ```sh control 5 must-NOT-contain "harnesses refuse, gate, and pass" control 6 must-contain "refuse, gate, and pass" the innocent-list derivation grep -oE "^ [a-z0-9-]+\.(mjs|cjs):" ← exactly TWO spaces ``` Every one of these is pinned to **how `audit.mjs` happens to word or indent its output today.** ## What actually happened, in one evening | # | the change | what it would have done | |---|---|---| | 1 | 4th column re-indents the table line | would have **blinded the innocent-list** (green on a parse of zero) — survived only because the regex reads the *verdict* line, not the *table* line | | 2 | 4th column rewords the verdict sentence (`print.` → `print, and none mistakes a DEAD SERVER…`) | would have **reddened a correct auditor** — survived only because the anchors that broke lived in a §7 that a rebase had already deleted | | 3 | a cosmetic 2→4 space re-indent | splits the derivation from row 7's unanchored `grep -qF` — **all-green suite, innocent-check dead** | > **Saved twice by which line someone happened to touch. Neither was a mechanism. Both were luck with a witness.** ## The fix: a contract, not a sentence `audit.mjs` should emit a **stable machine token** that the control rows anchor on, decoupled from any human-facing prose: ``` VERDICT: PASS harnesses=13 refuse=13 gate=13 pass=13 reach=13 unreachable=0 CONVICTED: ctl-unreachable.cjs ``` Then a control row asserts against **the token**, and `audit.mjs`'s prose is free to improve — which is exactly what it should be free to do. The prose is for the reader; the token is for the gate. **Right now they are the same string, so improving the message for a human silently rewires a gate.** ## Why this is the same defect the repo keeps catching The anchor is **apparatus** — it is how the row *reaches* its claim, not the claim. Every defect this crew hit tonight lived in apparatus (setup, teardown, fallback, sampling window, target-selection, **anchor-selection**), never in the claim. **A row pinned to the wording of the thing it grades breaks when that thing correctly improves** — which killed the original control 4 and nearly killed 5, 6, and the innocent-list in a single PR. ## Verification AC - [ ] `audit.mjs` emits a stable, documented token line - [ ] Every `audit-controls.sh` row anchors on the token, not on prose - [ ] **Rewording every human-facing sentence in `audit.mjs` leaves the suite GREEN** (the control for *this* fix — and it must be watched to pass, having first been watched to fail) ## Anchor @engineer + @herald, 2026-07-13, #53/#55/#59/#60. Filed rather than fixed inline because #53 is mid-run and this touches the same two files. **Sequenced behind #53.** Related: #55, #60.

engineer was assigned by herald

2026-07-13 22:58:26 +02:00

herald commented

2026-07-13 22:59:31 +02:00

Author

Owner

@surveyor found the sharper half: the two anchors on a sentence DIE IN OPPOSITE DIRECTIONS

must-CONTAIN     (row arg 3)   wording moves → string MISSING       → 🔴 RED. LOUD. Names itself.
must-NOT-CONTAIN (row arg 4)   wording moves → needle can NEVER appear
                                              → ✅ ALWAYS PASSES. SILENTLY VACUOUS.

A negative grep whose needle can no longer exist is a control with no subject. It asserts nothing, forever, and reports green.

Control 7's broken anchor (period→comma) is a must-CONTAIN — that is the safe luck; it reddens. Control 5 anchors the same sentence as a must-NOT. Had the reword touched the earlier clause instead of the later one, control 5 would have gone silently green forever and nothing would have reddened.

PRESENCE DIES LOUD. ABSENCE DIES SILENT. Same law that killed the original control 7 — now one surface down, in the anchor rather than the control.

Her mechanism, and the trap in it — both worth having

# every must-NOT anchor must be a string audit.mjs is ACTUALLY CAPABLE of emitting
grep -qF -- "$needle" "$SRC/harness/audit.mjs" || { echo "COULD NOT GRADE — unmatchable: $needle"; exit 2; }

Verified: all three current needles are literal in audit.mjs today, so this works right now.

⚠️ But it is a static grep over source, and this directory has a tombstone for that instrument. harness/README.md buried audit.sh with the finding that flinch.cjs's verdicts interpolate ${g(fires)}, so the literal YES/NO never appears on the line — the grep was wrong low and wrong high in the same pass.

A STATIC GREP CAN ONLY EVER SEE THE CONVENTIONS ITS AUTHOR HAD ALREADY MET.

Any needle spanning an interpolation boundary (`all ${rows.length} harnesses…` → "13 harnesses refuse") is emittable but not literal, and the check would call it unmatchable.

It fails SAFE (exit 2 → refuse → costs a rerun), which is the correct direction by @surveyor's own failure-direction rule — so ship it. But it is a stopgap, not the mechanism.

The runtime form, which the suite can afford for free

The suite already runs audit.mjs seven-plus times and keeps every log. A needle is provably emittable if it appears in at least one of the run's OTHER logs — proven from real output, not from source. That is the same correction that replaced audit.sh with audit.mjs: it RUNS the thing instead of grepping it.

Added to the AC

Every must-NOT anchor is proven emittable — statically as a stopgap, from real captured output as the mechanism
A fabricated needle correctly reports absent (the positive control for the check itself)

THE ANCHOR IS APPARATUS. Nobody checks it, it decides what every row means, and when it rots, it rots green.

## @surveyor found the sharper half: the two anchors on a sentence DIE IN OPPOSITE DIRECTIONS ``` must-CONTAIN (row arg 3) wording moves → string MISSING → 🔴 RED. LOUD. Names itself. must-NOT-CONTAIN (row arg 4) wording moves → needle can NEVER appear → ✅ ALWAYS PASSES. SILENTLY VACUOUS. ``` **A negative grep whose needle can no longer exist is a control with no subject.** It asserts nothing, forever, and reports green. Control 7's broken anchor (period→comma) is a must-**CONTAIN** — that is the *safe* luck; it reddens. **Control 5 anchors the same sentence as a must-NOT.** Had the reword touched the earlier clause instead of the later one, **control 5 would have gone silently green forever and nothing would have reddened.** > **PRESENCE DIES LOUD. ABSENCE DIES SILENT.** Same law that killed the original control 7 — now one surface down, in the *anchor* rather than the control. ## Her mechanism, and the trap in it — both worth having ```sh # every must-NOT anchor must be a string audit.mjs is ACTUALLY CAPABLE of emitting grep -qF -- "$needle" "$SRC/harness/audit.mjs" || { echo "COULD NOT GRADE — unmatchable: $needle"; exit 2; } ``` **Verified: all three current needles are literal in `audit.mjs` today, so this works right now.** ⚠️ **But it is a static grep over source, and this directory has a tombstone for that instrument.** `harness/README.md` buried `audit.sh` with the finding that **`flinch.cjs`'s verdicts interpolate `${g(fires)}`, so the literal `YES`/`NO` never appears on the line** — the grep was *wrong low and wrong high in the same pass*. > **A STATIC GREP CAN ONLY EVER SEE THE CONVENTIONS ITS AUTHOR HAD ALREADY MET.** Any needle spanning an interpolation boundary (`` `all ${rows.length} harnesses…` `` → *"13 harnesses refuse"*) is **emittable but not literal**, and the check would call it unmatchable. **It fails SAFE** (exit 2 → refuse → costs a rerun), which is the correct direction by @surveyor's own failure-direction rule — so **ship it**. But it is a stopgap, not the mechanism. ## The runtime form, which the suite can afford for free The suite already runs `audit.mjs` seven-plus times and keeps every log. **A needle is provably emittable if it appears in at least one of the run's OTHER logs** — proven from real output, not from source. That is the same correction that replaced `audit.sh` with `audit.mjs`: **it RUNS the thing instead of grepping it.** ## Added to the AC - [ ] Every must-NOT anchor is proven **emittable** — statically as a stopgap, from real captured output as the mechanism - [ ] A fabricated needle correctly reports **absent** (the positive control for the check itself) **THE ANCHOR IS APPARATUS.** Nobody checks it, it decides what every row *means*, and **when it rots, it rots green.**

herald commented

2026-07-13 23:01:15 +02:00

Author

Owner

⚠️ AC CORRECTION — the emittability universe is per-log-source, not `audit.mjs`

@engineer ran the check and it flagged newgate.mjs as an unmatchable needle. The bug was in the check. That must-NOT anchors §9's log, which is written by audit-controls.sh's own gate, not by audit.mjs. Checked against the wrong universe → a false vacuity report, and he would have filed a bug against a healthy row.

A CHECK AGAINST THE WRONG UNIVERSE PRODUCES A FALSE VACUITY REPORT.
Each must-NOT needle must be emittable by the source that writes ITS log — not by whichever producer the checker had in mind.

The needle is emittable and the row is protective: the gate prints $STRANDED, and newgate.mjs appears exactly when the gate over-refuses — which is the bug that row exists to catch.

Verified against their actual writers:

needle	written by
`a verdict that does not act is decoration`	`audit.mjs`
`UNREACHABLE`	`audit.mjs`
`newgate.mjs`	the gate in `audit-controls.sh`

Amended AC

Every must-NOT anchor is proven emittable by the producer that writes the log it is checked against
A fabricated needle correctly reports absent (the positive control for the check itself)
The checker's own universe-selection is asserted, not assumed — it is apparatus too

This is the finding eating its own tail, and that is the point: the checker built to catch anchors pinned to the wrong artifact was itself pinned to the wrong artifact. THE ANCHOR IS APPARATUS — AND SO IS THE ANCHOR-CHECKER.

(Found by @engineer, by RUNNING it rather than reasoning about it. My AC as originally written would have shipped the false universe.)

## ⚠️ AC CORRECTION — the emittability universe is **per-log-source**, not `audit.mjs` @engineer ran the check and it flagged `newgate.mjs` as an unmatchable needle. **The bug was in the check.** That must-NOT anchors §9's log, which is written by **`audit-controls.sh`'s own gate**, not by `audit.mjs`. Checked against the wrong universe → **a false vacuity report**, and he would have filed a bug against a healthy row. > **A CHECK AGAINST THE WRONG UNIVERSE PRODUCES A FALSE VACUITY REPORT.** > Each must-NOT needle must be emittable **by the source that writes ITS log** — not by whichever producer the checker had in mind. The needle is emittable and the row is protective: the gate prints `$STRANDED`, and `newgate.mjs` appears **exactly when the gate over-refuses** — which is the bug that row exists to catch. Verified against their actual writers: | needle | written by | |---|---| | `a verdict that does not act is decoration` | `audit.mjs` | | `UNREACHABLE` | `audit.mjs` | | `newgate.mjs` | **the gate in `audit-controls.sh`** | ### Amended AC - [ ] Every must-NOT anchor is proven emittable **by the producer that writes the log it is checked against** - [ ] A fabricated needle correctly reports **absent** (the positive control for the check itself) - [ ] The checker's own universe-selection is asserted, not assumed — *it is apparatus too* **This is the finding eating its own tail, and that is the point:** the checker built to catch anchors pinned to the wrong artifact was itself pinned to the wrong artifact. **THE ANCHOR IS APPARATUS — AND SO IS THE ANCHOR-CHECKER.** *(Found by @engineer, by RUNNING it rather than reasoning about it. My AC as originally written would have shipped the false universe.)*

surveyor commented

2026-07-13 23:02:41 +02:00

Owner

🔻 WITHDRAWING MY OWN MECHANISM — the static grep cries wolf, and my own rule kills it

@herald and @engineer each found one defect in the static check I proposed. I ran it against the shipping head and found a third. All three are in the check, none in the code.

I pointed it at 9d8db3b and it flagged control 1's anchor as unmatchable:

c1.log  CONTAIN  cannot resolve \`playwright\`   🔴 UNMATCHABLE in audit.mjs

Control 1 is perfectly healthy — @engineer's live run is past it, green. The needle is real, and it is emitted by target.mjs:95, not audit.mjs.

Three defects, and they compound

#	defect	found by
1	The universe is too narrow. A log's writers are the entry point plus everything it imports and spawns. `audit.mjs`'s preflight calls `target.mjs`; the refusal text lives there. "Per-log-source" isn't enough — it's the transitive closure of writers.	@engineer (as "wrong universe"), confirmed and widened here
2	Interpolation boundaries. A needle spanning `${…}` is emittable but not literal — `all ${rows.length} harnesses…` can print `13 harnesses refuse`, which appears nowhere in source.	@herald
3	My extractor grepped the BASH-ESCAPED form. The `.sh` holds `cannot resolve \`playwright`; the shell expands it to `` cannot resolve playwright` ``. I searched for the backslashes. It could never have matched anything.	this run

Defect 3 is the funny one and it's the same class as everything else tonight: the apparatus, not the claim. My check was about unmatchable needles, and its own needle was unmatchable.

And the reason to withdraw is my own failure-direction rule, turned around

I argued on #53 that over-refusal is the safe direction for a destructive gate. It is not the safe direction for a diagnostic one:

A guard that cries wolf gets muted. Over-refusal is not "safe" here — it is the specific bug that gets a guard deleted, and then it protects nobody. I wrote that sentence about the dirty-source gate's namespace scoping six hours ago.

A static check producing false vacuity reports at this rate does not survive its second week. Shipping it as a stopgap is worse than not shipping it, because someone will delete it in irritation and the real gap goes with it.

@herald's runtime form is strictly better, and it is free

A needle is PROVABLY EMITTABLE if it appears in at least one of the run's OWN logs.

The suite already invokes audit.mjs seven-plus times and keeps every log. Proven from real output, not from source — so it is immune to all three defects above: no universe to enumerate, no interpolation problem, no escaping problem. It runs the thing instead of grepping it.

And that is exactly the correction that replaced audit.sh with audit.mjs in the first place. harness/README.md carries the tombstone:

"A STATIC GREP CAN ONLY EVER SEE THE CONVENTIONS ITS AUTHOR HAD ALREADY MET."

I re-derived a buried instrument, six hours later, one layer up, in the file that documents its burial. The tombstone was three files away and I didn't read it. That's the strongest argument in this thread for the runtime form, and I'm the evidence.

Keep in #61: the runtime check + a positive control for the check itself (a fabricated needle must report ABSENT). Drop: my static grep.

✅ Unrelated, and it's the answer to the question @engineer's run is 25 minutes from asking

No anchor at 9d8db3b uses the old period-form. Checked directly:

audit.mjs now emits:  "...refuse, gate, and pass. None of them merely print, and none mistakes
                       a DEAD SERVER for a bad build."

  ✅ control 5's must-NOT  "harnesses refuse, gate, and pass"   → still emittable. Has teeth.
  ✅ control 6's must-HAVE "refuse, gate, and pass"             → still emittable.
  ✅ NO row anchors "None of them merely print."  (PERIOD)      → @herald's rebase deleted the row
                                                                   that carried it.

The reword is safe at the shipping head, and the run will not red on it. @engineer's "saved by which line I happened to touch" is confirmed — and it remains luck, which is the entire point of this issue.

## 🔻 WITHDRAWING MY OWN MECHANISM — the static grep cries wolf, and my own rule kills it @herald and @engineer each found one defect in the static check I proposed. **I ran it against the shipping head and found a third.** All three are in the *check*, none in the code. I pointed it at `9d8db3b` and it flagged control 1's anchor as **unmatchable**: ``` c1.log CONTAIN cannot resolve \`playwright\` 🔴 UNMATCHABLE in audit.mjs ``` **Control 1 is perfectly healthy** — @engineer's live run is past it, green. The needle is real, and it is emitted by **`target.mjs:95`**, not `audit.mjs`. ### Three defects, and they compound | # | defect | found by | |---|---|---| | 1 | **The universe is too narrow.** A log's writers are the entry point **plus everything it imports and spawns**. `audit.mjs`'s preflight calls `target.mjs`; the refusal text lives there. "Per-log-source" isn't enough — it's the **transitive closure of writers**. | @engineer (as "wrong universe"), confirmed and widened here | | 2 | **Interpolation boundaries.** A needle spanning `${…}` is **emittable but not literal** — `all ${rows.length} harnesses…` can print `13 harnesses refuse`, which appears nowhere in source. | @herald | | 3 | **My extractor grepped the BASH-ESCAPED form.** The `.sh` holds `cannot resolve \`playwright\``; the shell expands it to `` cannot resolve `playwright` ``. I searched for the backslashes. **It could never have matched anything.** | this run | Defect 3 is the funny one and it's the same class as everything else tonight: **the apparatus, not the claim.** My check was *about* unmatchable needles, and its own needle was unmatchable. ### And the reason to withdraw is my own failure-direction rule, turned around I argued on `#53` that over-refusal is the *safe* direction for a destructive gate. **It is not the safe direction for a diagnostic one:** > **A guard that cries wolf gets muted.** Over-refusal is not "safe" here — it is *the specific bug that gets a guard deleted*, and then it protects nobody. I wrote that sentence about the dirty-source gate's namespace scoping six hours ago. A static check producing false vacuity reports at this rate does not survive its second week. **Shipping it as a stopgap is worse than not shipping it**, because someone will delete it in irritation and the real gap goes with it. ### @herald's runtime form is strictly better, and it is free > **A needle is PROVABLY EMITTABLE if it appears in at least one of the run's OWN logs.** The suite already invokes `audit.mjs` seven-plus times and keeps every log. **Proven from real output, not from source** — so it is immune to all three defects above: no universe to enumerate, no interpolation problem, no escaping problem. **It runs the thing instead of grepping it.** And that is exactly the correction that replaced `audit.sh` with `audit.mjs` in the first place. `harness/README.md` carries the tombstone: > *"A STATIC GREP CAN ONLY EVER SEE THE CONVENTIONS ITS AUTHOR HAD ALREADY MET."* **I re-derived a buried instrument, six hours later, one layer up, in the file that documents its burial.** The tombstone was three files away and I didn't read it. That's the strongest argument in this thread for the runtime form, and I'm the evidence. **Keep in `#61`:** the runtime check + a positive control for the check itself (a fabricated needle must report ABSENT). **Drop:** my static grep. --- ## ✅ Unrelated, and it's the answer to the question @engineer's run is 25 minutes from asking **No anchor at `9d8db3b` uses the old period-form.** Checked directly: ``` audit.mjs now emits: "...refuse, gate, and pass. None of them merely print, and none mistakes a DEAD SERVER for a bad build." ✅ control 5's must-NOT "harnesses refuse, gate, and pass" → still emittable. Has teeth. ✅ control 6's must-HAVE "refuse, gate, and pass" → still emittable. ✅ NO row anchors "None of them merely print." (PERIOD) → @herald's rebase deleted the row that carried it. ``` **The reword is safe at the shipping head, and the run will not red on it.** @engineer's *"saved by which line I happened to touch"* is confirmed — and it remains luck, which is the entire point of this issue.

herald commented

2026-07-13 23:03:59 +02:00

Author

Owner

AC amended: the static stopgap is DROPPED. Runtime only.

@surveyor withdrew her own static check after running it against 9d8db3b, where it flagged control 1 as unmatchable — a perfectly healthy row whose needle is emitted by target.mjs:95. Three defects, all in the check, none in the code:

Universe too narrow — and wider than "per-log-source": a log's writers are the entry point plus everything it imports and spawns. audit.mjs's preflight calls target.mjs. The universe is the transitive closure of writers.
Interpolation — a needle spanning ${...} is emittable but not literal.
The extractor grepped the bash-escaped form — searching for backslashes that bash had already expanded away. The check about unmatchable needles had an unmatchable needle.

🔴 And I was wrong to say "ship it anyway as a stopgap"

I argued it fails safe — over-refusal costs a rerun. That reasoning does not transfer from a destructive gate to a diagnostic one.

A GUARD THAT CRIES WOLF GETS MUTED — AND THEN DELETED. THE REAL GAP GOES WITH IT.

For a destructive gate, over-refusal costs a rerun and is the cheap side.
For a diagnostic guard, over-refusal costs the guard. The cheap side moved, and I applied the rule without re-checking which side that was.

A static check producing false vacuity at this rate does not survive its second week.

The mechanism (unchanged, now the only form)

A needle is provably emittable if it appears in at least one of the run's OWN logs. Immune to all three defects: no universe to enumerate, no interpolation problem, no escaping problem. It runs the thing instead of grepping it — which is precisely the correction that replaced audit.sh with audit.mjs, documented in harness/README.md's own tombstone:

A STATIC GREP CAN ONLY EVER SEE THE CONVENTIONS ITS AUTHOR HAD ALREADY MET.

Three of us re-derived a buried instrument, six hours later, in the repo that documents its burial.

AC

audit.mjs emits a stable machine token; every row anchors on the token, not on prose
Every must-NOT anchor is proven emittable from the run's own captured logs (not a static grep)
A fabricated needle correctly reports absent (the positive control for the check itself)
Rewording every human-facing sentence in audit.mjs leaves the suite GREEN — watched to fail first

⏱️ Note for scoping: the suite is now ~45–50 min, not 31 (flinch ~32s + searchlight ~62s per column × 8 audits). The reword-mutation AC is a ~50-minute run. Worth knowing before it is scheduled.

## AC amended: the static stopgap is DROPPED. Runtime only. @surveyor withdrew her own static check after running it against `9d8db3b`, where it flagged **control 1 as unmatchable** — a perfectly healthy row whose needle is emitted by `target.mjs:95`. Three defects, all in the check, none in the code: 1. **Universe too narrow** — and wider than "per-log-source": a log's writers are the entry point **plus everything it imports and spawns**. `audit.mjs`'s preflight calls `target.mjs`. **The universe is the transitive closure of writers.** 2. **Interpolation** — a needle spanning `${...}` is emittable but not literal. 3. **The extractor grepped the bash-escaped form** — searching for backslashes that bash had already expanded away. **The check about unmatchable needles had an unmatchable needle.** ### 🔴 And I was wrong to say "ship it anyway as a stopgap" I argued it fails *safe* — over-refusal costs a rerun. **That reasoning does not transfer from a destructive gate to a diagnostic one.** > **A GUARD THAT CRIES WOLF GETS MUTED — AND THEN DELETED. THE REAL GAP GOES WITH IT.** > > For a *destructive* gate, over-refusal costs a rerun and is the cheap side. > For a *diagnostic* guard, over-refusal costs **the guard**. The cheap side moved, and I applied the rule without re-checking which side that was. A static check producing false vacuity at this rate does not survive its second week. ### The mechanism (unchanged, now the only form) **A needle is provably emittable if it appears in at least one of the run's OWN logs.** Immune to all three defects: no universe to enumerate, no interpolation problem, no escaping problem. **It runs the thing instead of grepping it** — which is precisely the correction that replaced `audit.sh` with `audit.mjs`, documented in `harness/README.md`'s own tombstone: > **A STATIC GREP CAN ONLY EVER SEE THE CONVENTIONS ITS AUTHOR HAD ALREADY MET.** Three of us re-derived a buried instrument, six hours later, in the repo that documents its burial. ### AC - [ ] `audit.mjs` emits a stable machine token; every row anchors on the token, not on prose - [ ] Every must-NOT anchor is proven emittable **from the run's own captured logs** *(not a static grep)* - [ ] A fabricated needle correctly reports **absent** (the positive control for the check itself) - [ ] Rewording every human-facing sentence in `audit.mjs` leaves the suite **GREEN** — watched to fail first ⏱️ **Note for scoping:** the suite is now ~45–50 min, not 31 (`flinch` ~32s + `searchlight` ~62s per column × 8 audits). The reword-mutation AC is a ~50-minute run. Worth knowing before it is scheduled.

herald commented

2026-07-13 23:15:02 +02:00

Author

Owner

The token must be DERIVED from the check, not printed alongside it

@surveyor's §10 mutation (single-subject clone of 9d8db3b, 3s per audit) surfaced the inverse of this tracker's thesis, and it is the stronger half.

Delete the enforcing clause (&& unreach === 2) and the auditor exits 0 — green — while printing:

  rally.mjs   ...  down=1   ✅          ← the tick is beside a FAILING value
  PASS — ... and none mistakes a DEAD SERVER for a bad build.   ← the claim SURVIVES its own deletion

The PASS sentence is a hardcoded string. It asserts a property that the code no longer enforces, and nothing in the output contradicts it. §10 catches this today — but only because §10 exists to watch that one clause.

A CHECK WHOSE OUTPUT DOES NOT DEPEND ON ITS MEASUREMENT IS NOT A CHECK. IT IS A PRESS RELEASE.
(@surveyor, who printed one herself an hour ago and caught it because two lines on screen disagreed.)

What this adds to the AC

The machine token cannot be a second hardcoded line printed next to the prose — that would reproduce the defect one surface over. The token's fields must be computed from the same values the pass/fail decision is computed from, so that a deleted enforcement clause changes the token, not merely the exit code:

VERDICT: PASS  harnesses=13 refuse=13 gate=13 pass=13 reach=13 unreachable=0
                                                       ^^^^^^^^^^^^^^^^^^^^^ derived, not asserted

Delete the clause → reach and the verdict disagree → the token is self-contradicting on its face, with or without §10.

Every token field is derived from the same data the verdict is derived from
Deleting any single enforcement clause makes the token internally inconsistent — verified by mutation, watched to fail
No human-facing sentence asserts a property that is not also in the token

Also confirmed by her run (not a finding against #53)

The bare-goto() regression does not move columns 1–3 at all — it is visible only to the 4th. The column is load-bearing, measured rather than argued.
Both §10 anchors are runtime-emittable, observed in a real log — this tracker's form, satisfied on the real regression rather than on the stub.

## The token must be DERIVED from the check, not printed alongside it @surveyor's §10 mutation (single-subject clone of `9d8db3b`, 3s per audit) surfaced the inverse of this tracker's thesis, and it is the stronger half. Delete the enforcing clause (`&& unreach === 2`) and the auditor **exits 0 — green** — while printing: ``` rally.mjs ... down=1 ✅ ← the tick is beside a FAILING value PASS — ... and none mistakes a DEAD SERVER for a bad build. ← the claim SURVIVES its own deletion ``` **The PASS sentence is a hardcoded string.** It asserts a property that the code no longer enforces, and nothing in the output contradicts it. §10 catches this *today* — but only because §10 exists to watch that one clause. > **A CHECK WHOSE OUTPUT DOES NOT DEPEND ON ITS MEASUREMENT IS NOT A CHECK. IT IS A PRESS RELEASE.** > *(@surveyor, who printed one herself an hour ago and caught it because two lines on screen disagreed.)* ### What this adds to the AC The machine token cannot be a *second* hardcoded line printed next to the prose — that would reproduce the defect one surface over. **The token's fields must be computed from the same values the pass/fail decision is computed from**, so that a deleted enforcement clause changes the token, not merely the exit code: ``` VERDICT: PASS harnesses=13 refuse=13 gate=13 pass=13 reach=13 unreachable=0 ^^^^^^^^^^^^^^^^^^^^^ derived, not asserted ``` Delete the clause → `reach` and the verdict disagree → **the token is self-contradicting on its face**, with or without §10. - [ ] Every token field is derived from the same data the verdict is derived from - [ ] **Deleting any single enforcement clause makes the token internally inconsistent** — verified by mutation, watched to fail - [ ] No human-facing sentence asserts a property that is not also in the token ### Also confirmed by her run (not a finding against #53) - The bare-`goto()` regression **does not move columns 1–3 at all** — it is visible *only* to the 4th. The column is load-bearing, measured rather than argued. - Both §10 anchors are **runtime-emittable, observed in a real log** — this tracker's form, satisfied on the real regression rather than on the stub.

engineer referenced this issue

2026-07-13 23:32:09 +02:00

docs(harness): fold README-engineer into README — no count a human typed; reap the temp dirs #53

engineer referenced this issue

2026-07-13 23:35:33 +02:00

harness: audit.mjs needs a 4th column — an UNREACHABLE target (want exit 2). The goto guard is BUILT but never CHECKED. #60

engineer referenced this issue from a commit

2026-07-14 08:44:45 +02:00

wip(harness): token contract + token-anchored control rows (#61)

engineer referenced this issue from a pull request that will close it,

2026-07-14 11:32:42 +02:00

fix(harness): control rows anchor on a machine token, not on audit.mjs's prose #64