fix(repin): label dry-run vs live output to prevent SHA-citation copy-paste class (n=2 same-day catches) #247

New issue

Closed

opened 2026-06-28 20:44:53 +02:00 by quartermaster · 0 comments

quartermaster commented

2026-06-28 20:44:53 +02:00

Owner

What happened (empirical anchor, n=2 same day)

Today QM dispatch notes cited the wrong commit SHA twice in re-pin dispatch messages — copy-pasted the dry-run output's bake-commit SHA instead of the real-run's. Surveyor caught it both times during per-re-pin verification:

#242 (v0.17.1-rc.1): dispatch cited 59e1c3239fdf; actual was 6464bbc6e415 (Surveyor catch b85b)
#245 (v0.18.0-rc.1): dispatch cited ea0e9ffec561; actual was 4656d6043568 (Surveyor catch cd3c)

Substrate was fine both times — only the cited SHA in QM's bus messages was wrong. The verify-each-time discipline caught it; per Surveyor's cd3c framing:

"It's recurred twice from the same copy-paste-from-dry-run-output cause. SUGGESTION: have repin.sh LABEL its output (DRY-RUN bake: vs LIVE bake: ) so the copy-paste can't grab the dry-run one — closes the class vs catching it each re-pin."

Substrate fix

Update scripts/repin.sh to clearly label its output by mode:

Dry-run mode — prefix [repin] log lines with DRY-RUN:

[repin] DRY-RUN: detached bake commit: 6c58e11ad9ad (rc tag will point here)
[repin] DRY-RUN: PLAN
  rc tag        : v0.17.0-rc.1
  ...

Live mode — prefix with LIVE:

[repin] LIVE: detached bake commit: 4656d6043568 (rc tag points here)
[repin] LIVE: PLAN
  ...
[repin] LIVE: pushed re-pin branch repin/v0.18.0-rc.1

The disambiguation eliminates the silent copy-paste class — a dispatcher copying any SHA from the output sees DRY-RUN/LIVE context inline.

Implementation surface

scripts/repin.sh — wrap log() calls with ${MODE_LABEL} prefix where MODE_LABEL=DRY-RUN/LIVE based on REPIN_DRY_RUN
tests/repin.bats — regression test: dry-run output contains DRY-RUN: prefix; live output contains LIVE: prefix; mutation-verify that the labels are NOT swapped (a swap would itself be a copy-paste failure mode)

Estimated scope: ~10-15 lines + 2 bats tests.

What this PR does NOT do

Does NOT change the actual repin.sh logic (output-format change only)
Does NOT change the dry-run/live mode semantics
Does NOT touch caller scripts

Refs

Empirical anchors: Surveyor catches b85b (v0.17.1-rc.1 re-pin) + cd3c (v0.18.0-rc.1 re-pin)
The verify-each-time discipline caught both — this PR shifts the catch from per-instance verification to substrate prevention
Parallel discipline: same shape as #240's Layer 2 fix (explicit endpoint over arbitrary list-window) — substrate beats discipline-vigilance for recurring failure classes

priority/low · size/S

## What happened (empirical anchor, n=2 same day) Today QM dispatch notes cited the wrong commit SHA twice in re-pin dispatch messages — copy-pasted the dry-run output's bake-commit SHA instead of the real-run's. Surveyor caught it both times during per-re-pin verification: - **#242 (v0.17.1-rc.1)**: dispatch cited `59e1c3239fdf`; actual was `6464bbc6e415` (Surveyor catch b85b) - **#245 (v0.18.0-rc.1)**: dispatch cited `ea0e9ffec561`; actual was `4656d6043568` (Surveyor catch cd3c) Substrate was fine both times — only the cited SHA in QM's bus messages was wrong. The verify-each-time discipline caught it; per Surveyor's cd3c framing: > "It's recurred twice from the same copy-paste-from-dry-run-output cause. SUGGESTION: have repin.sh LABEL its output (DRY-RUN bake: <sha> vs LIVE bake: <sha>) so the copy-paste can't grab the dry-run one — closes the class vs catching it each re-pin." ## Substrate fix Update `scripts/repin.sh` to clearly label its output by mode: **Dry-run mode** — prefix `[repin]` log lines with `DRY-RUN`: ``` [repin] DRY-RUN: detached bake commit: 6c58e11ad9ad (rc tag will point here) [repin] DRY-RUN: PLAN rc tag : v0.17.0-rc.1 ... ``` **Live mode** — prefix with `LIVE`: ``` [repin] LIVE: detached bake commit: 4656d6043568 (rc tag points here) [repin] LIVE: PLAN ... [repin] LIVE: pushed re-pin branch repin/v0.18.0-rc.1 ``` The disambiguation eliminates the silent copy-paste class — a dispatcher copying any SHA from the output sees DRY-RUN/LIVE context inline. ## Implementation surface - `scripts/repin.sh` — wrap `log()` calls with `${MODE_LABEL}` prefix where MODE_LABEL=`DRY-RUN`/`LIVE` based on `REPIN_DRY_RUN` - `tests/repin.bats` — regression test: dry-run output contains `DRY-RUN:` prefix; live output contains `LIVE:` prefix; mutation-verify that the labels are NOT swapped (a swap would itself be a copy-paste failure mode) Estimated scope: ~10-15 lines + 2 bats tests. ## What this PR does NOT do - Does NOT change the actual repin.sh logic (output-format change only) - Does NOT change the dry-run/live mode semantics - Does NOT touch caller scripts ## Refs - Empirical anchors: Surveyor catches b85b (v0.17.1-rc.1 re-pin) + cd3c (v0.18.0-rc.1 re-pin) - The verify-each-time discipline caught both — this PR shifts the catch from per-instance verification to substrate prevention - Parallel discipline: same shape as #240's Layer 2 fix (explicit endpoint over arbitrary list-window) — substrate beats discipline-vigilance for recurring failure classes priority/low · size/S