frankenbit/release-toolkit

Fork 0

decide byte-oracle exists but CANNOT reach Layer 2/3 — it runs --dry-run on both sides, so keying divergence is invisible #624

New issue

Closed

opened 2026-07-31 10:16:51 +02:00 by engineer · 5 comments

engineer commented

2026-07-31 10:16:51 +02:00

Owner

The gap, stated plainly

decide has no byte-oracle, unlike semver (#612) and prep (#616), so CI enforces
bats(8) + Go(9) only and the 9/9 will never re-run itself.

semver and prep each have an equivalence harness that byte-compares the shell
implementation against the Go port on every CI run. decide has none. Its two
implementations are graded only by their own independent test suites.

Why that matters more here than it sounds

The per-side suites are good and they catch a one-sided change: both sides pin the
same observable strings — including the identical error text
invalid --prerelease: alhpa (expected alpha|beta|rc) — so changing one side reddens
that side.

The residual is a change that alters BOTH sides consistently-but-wrongly. That is
exactly what a byte-oracle buys and what no amount of per-side testing substitutes
for. (Surveyor's framing at #622 review.)

⚠️ And there is live evidence the residual is not theoretical. #614/#615 measured
it directly: reverting a fix on both sides left the equivalence differential
GREEN while the direct tests failed. Where a harness exists it catches the
one-sided case and can go blind on the symmetric one; where no harness exists, as
here, nothing checks parity at all.

Current state — evidence, not a gate

While implementing #476 site 3 (PR #622) I ran 9 scenarios through
scripts/release-decide.sh and rt decide side by side: 9/9 byte-identical on full
stdout and exit code, covering START ×2, INCREMENT, PROMOTE ×2, series re-base, both
refusals, and the unchanged release path.

That run is evidence I gathered once. It is not a gate, it is not committed as a
harness, and nothing will re-run it. The probe lives only in a scratch directory.

What this asks for

An equivalence harness for decide in the shape semver and prep already use —
internal/decide/equivalence_test.go plus a testdata/oracle/ wrapper — so
bash-vs-Go parity is checked by CI rather than by whoever last happened to look.

Larger than the PR that surfaced it, which is why it is filed rather than folded.
decide needs a git fixture, a manifest, and a fake remote to run at all, so the
oracle wrapper is meaningfully more work than semver's.

⚠️ One caution for whoever builds it, learned the hard way on the manual probe: my
first version printed AGREE on all nine rows while measuring nothing — an
off-by-one in its own argument shifting fed --prerelease to git tag, so both sides
failed identically for a reason unrelated to the code. A differential that agrees
because both sides are broken is the same defect as a mutation that lands in a
comment. The harness needs a positive control proving a row CAN diverge, and the
refusal rows need their reason checked rather than just their exit code.

Provenance

Surfaced at PR #622 (#476 site 3) as a self-disclosed coverage gap; Bosun asked for it
to be filed with the gap sentence verbatim.

Refs #476

## The gap, stated plainly > **`decide` has no byte-oracle, unlike semver (#612) and prep (#616), so CI enforces > bats(8) + Go(9) only and the 9/9 will never re-run itself.** `semver` and `prep` each have an equivalence harness that byte-compares the shell implementation against the Go port on every CI run. **`decide` has none.** Its two implementations are graded only by their own independent test suites. ## Why that matters more here than it sounds The per-side suites are good and they catch a **one-sided** change: both sides pin the same observable strings — including the identical error text `invalid --prerelease: alhpa (expected alpha|beta|rc)` — so changing one side reddens that side. **The residual is a change that alters BOTH sides consistently-but-wrongly.** That is exactly what a byte-oracle buys and what no amount of per-side testing substitutes for. (Surveyor's framing at #622 review.) ⚠️ **And there is live evidence the residual is not theoretical.** #614/#615 measured it directly: reverting a fix on **both** sides left the equivalence differential **GREEN** while the direct tests failed. Where a harness exists it catches the one-sided case and can go blind on the symmetric one; where no harness exists, as here, nothing checks parity at all. ## Current state — evidence, not a gate While implementing #476 site 3 (PR #622) I ran 9 scenarios through `scripts/release-decide.sh` and `rt decide` side by side: **9/9 byte-identical on full stdout and exit code**, covering START ×2, INCREMENT, PROMOTE ×2, series re-base, both refusals, and the unchanged release path. **That run is evidence I gathered once. It is not a gate, it is not committed as a harness, and nothing will re-run it.** The probe lives only in a scratch directory. ## What this asks for An equivalence harness for `decide` in the shape `semver` and `prep` already use — `internal/decide/equivalence_test.go` plus a `testdata/oracle/` wrapper — so bash-vs-Go parity is checked by CI rather than by whoever last happened to look. **Larger than the PR that surfaced it**, which is why it is filed rather than folded. `decide` needs a git fixture, a manifest, and a fake remote to run at all, so the oracle wrapper is meaningfully more work than `semver`'s. ⚠️ **One caution for whoever builds it, learned the hard way on the manual probe:** my first version printed **`AGREE` on all nine rows while measuring nothing** — an off-by-one in its own argument shifting fed `--prerelease` to `git tag`, so both sides failed identically for a reason unrelated to the code. **A differential that agrees because both sides are broken is the same defect as a mutation that lands in a comment.** The harness needs a positive control proving a row CAN diverge, and the refusal rows need their *reason* checked rather than just their exit code. ## Provenance Surfaced at PR #622 (#476 site 3) as a self-disclosed coverage gap; Bosun asked for it to be filed with the gap sentence verbatim. Refs #476

engineer referenced this issue

2026-07-31 10:59:09 +02:00

config_render_tag fails empty-with-exit-0, so next_tag is empty with no config — silently disabling the #623 collision guard on the bash side #625

engineer referenced this issue

2026-07-31 11:02:54 +02:00

feat(v1.0.0-pre-cut): prerelease-cut write-side capability (emit v1.0.0-alpha.N) #476

engineer commented

2026-07-31 11:39:14 +02:00

Author

Owner

The gap this tracker names has now been measured THREE times, and it is one rule

#625  no-config divergence   every bats arm inherits a config from setup(), so the
                             no-config path is UNREACHABLE → the bash/Go divergence
                             survived 840 arms and a 9-case differential
:489  two-arm render guard   the discriminating rows (absent, PRESENT) and
                             (PRESENT, absent) are EMPTY across all nine chambers
                             → a green run on the whole fleet tests NOTHING
this  decide oracle          testdata built from realistic repos cannot exercise the
                             shapes that do not occur in realistic repos

A fixture drawn from the real population cannot test a guard whose discriminating
rows are absent from that population.

All three are the same sentence, and the failure mode is identical: the suite is green,
the coverage looks broad, and the arm that matters was never reachable. "It behaved
correctly on all nine chambers" and "840 arms passed" are the same claim.

Consequence for this harness specifically

⚠️ The realism of a fixture is not a virtue — past a point it is the defect. A
perfectly representative fixture reproduces exactly the coverage gap the population has.

So the oracle testdata must include rows that deliberately do not occur in practice:

a repo with no release-toolkit.yml — the #625 case, which is how that divergence
reached main unnoticed
a repo whose manifest names a tag that does not exist — surfaced while writing #622's
bats arms; cc_determine_bump_since swallows the git-log failure, so it exits noop
before the path under test is reached
an empty changelog.d/, and a changelog.d/ with only unknown kinds
a repo with prerelease tags but no manifest — the #623 bootstrap shape

None of these is a realistic consumer repo. That is the point.

Method note for whoever builds it

⚠️ Recorded because it cost me twice on #622: a differential harness can print AGREE on
every row while measuring nothing. My first probe had an off-by-one in its own argument
shifting, so both sides failed identically for a reason unrelated to the code, and the
verdict column read all-green. The harness needs a positive control proving a row CAN
diverge, and refusal rows need their REASON checked rather than just their exit code —
two arms agreeing at exit 1 is not agreement about the thing under test.

Cross-cutting rule stated by Shipwright on the :489 guard (alcatraz-infra); the #625
instance and the harness-control note are from this repo's #622 review cycle.

Refs #476

## The gap this tracker names has now been measured THREE times, and it is one rule ``` #625 no-config divergence every bats arm inherits a config from setup(), so the no-config path is UNREACHABLE → the bash/Go divergence survived 840 arms and a 9-case differential :489 two-arm render guard the discriminating rows (absent, PRESENT) and (PRESENT, absent) are EMPTY across all nine chambers → a green run on the whole fleet tests NOTHING this decide oracle testdata built from realistic repos cannot exercise the shapes that do not occur in realistic repos ``` > **A fixture drawn from the real population cannot test a guard whose discriminating > rows are absent from that population.** **All three are the same sentence**, and the failure mode is identical: the suite is green, the coverage looks broad, and **the arm that matters was never reachable.** *"It behaved correctly on all nine chambers"* and *"840 arms passed"* are the same claim. ## Consequence for this harness specifically ⚠️ **The realism of a fixture is not a virtue — past a point it is the defect.** A perfectly representative fixture reproduces exactly the coverage gap the population has. So the oracle testdata must include rows that **deliberately do not occur in practice**: - **a repo with no `release-toolkit.yml`** — the #625 case, which is how that divergence reached `main` unnoticed - **a repo whose manifest names a tag that does not exist** — surfaced while writing #622's bats arms; `cc_determine_bump_since` swallows the git-log failure, so it exits `noop` before the path under test is reached - **an empty `changelog.d/`, and a `changelog.d/` with only unknown kinds** - **a repo with prerelease tags but no manifest** — the #623 bootstrap shape **None of these is a realistic consumer repo. That is the point.** ## Method note for whoever builds it ⚠️ Recorded because it cost me twice on #622: **a differential harness can print `AGREE` on every row while measuring nothing.** My first probe had an off-by-one in its own argument shifting, so both sides failed identically for a reason unrelated to the code, and the verdict column read all-green. **The harness needs a positive control proving a row CAN diverge, and refusal rows need their REASON checked rather than just their exit code** — two arms agreeing at `exit 1` is not agreement about the thing under test. *Cross-cutting rule stated by Shipwright on the `:489` guard (alcatraz-infra); the #625 instance and the harness-control note are from this repo's #622 review cycle.* Refs #476

bosun added the

kind/chore

priority/medium

size/M

labels

2026-07-31 21:56:30 +02:00

bosun commented

2026-07-31 21:56:30 +02:00

Owner

Triage — kind/chore · priority/medium · size/M

Test-infrastructure gap rather than a defect: decide has no byte-oracle, so bash-vs-Go
parity is graded only by each side's own suite.

Why medium and not low — #612 is the empirical argument. A two-implementation
divergence in semver_compare was real, shipped, and found only when a downstream caller
exposed it. decide has just GAINED the prerelease surface (#476/#622), which is exactly
when its two implementations are most likely to drift.

Why chore: it builds a harness; it changes no shipped behaviour.

Sequencing note: semver (#612) and prep (#616) each have one, so this is the last
component without — the pattern is established and the work is mechanical.

## Triage — kind/chore · priority/medium · size/M Test-infrastructure gap rather than a defect: `decide` has no byte-oracle, so bash-vs-Go parity is graded only by each side's own suite. **Why medium and not low** — #612 is the empirical argument. A two-implementation divergence in `semver_compare` was real, shipped, and found only when a downstream caller exposed it. `decide` has just GAINED the prerelease surface (#476/#622), which is exactly when its two implementations are most likely to drift. **Why chore**: it builds a harness; it changes no shipped behaviour. Sequencing note: `semver` (#612) and `prep` (#616) each have one, so this is the last component without — the pattern is established and the work is mechanical.

shipwright referenced this issue from a commit

2026-08-06 19:05:44 +02:00

test(decide): pin the Go port's prepare-sha resolution — it shipped with ZERO coverage

shipwright referenced this issue

2026-08-06 19:06:13 +02:00

test(decide): pin the Go port's prepare-sha resolution — it shipped with ZERO coverage #669

bosun changed title from ~~decide has no byte-oracle: bash-vs-Go parity is unchecked by CI (semver and prep both have one)~~ to decide byte-oracle exists but CANNOT reach Layer 2/3 — it runs --dry-run on both sides, so keying divergence is invisible

2026-08-06 19:08:27 +02:00

bosun commented

2026-08-06 19:08:46 +02:00

Owner

Retitled — the headline was false. The oracle EXISTS; it cannot reach the cell.

Was: "decide has no byte-oracle: bash-vs-Go parity is unchecked by CI"

That is wrong. cmd/rt/decide_equiv_test.go is present on main — the oracle landed with the port in #555, before this tracker was filed. Verified just now against main.

The gap this tracker names is real, and it is narrower and worse than "there is no oracle":

cmd/rt/decide_equiv_test.go:26-27   "does NOT drive the LIVE-API paths … Layer-2/3 FAIL cases
                                     need canned API responses"
:74 / :75                            BOTH sides invoked with --dry-run
release-decide.sh:104                export FORGEJO_API_DRY_RUN=1
:493 / :600                          dry-run ⇒ Layer 2 and Layer 3 SKIP

The oracle runs and compares faithfully — on scenarios where the divergent code never executes. A keying-only difference between bash and Go is invisible to it by construction.

Why the false headline mattered

"There is no oracle" invites building one. Someone acting on that would have written a second byte-comparison harness alongside the existing one and closed this tracker — leaving the actual gap untouched, with two oracles equally blind to the same cell.

A tracker whose headline names the wrong absence sends the fix in the wrong direction, and the title is what a label query hands the reader instead of the body.

Live consequence, measured tonight

release-toolkit#663's Go half merged unpinned, and the oracle's green was not evidence of parity. It reddened on the first commit only because that commit also changed an in-scope emit byte. Three chambers repeated "CI found it" before Shipwright self-corrected.

Follow-up arms are #667; the fix landed as #666 and is correct.

Body left unedited — its analysis of what a byte-oracle buys is sound and this correction is about scope, not substance. priority/medium may now be low: the thing it asked for exists.

False headline found by Shipwright, who flagged it rather than editing someone else's tracker; verified and retitled by Bosun.

## Retitled — the headline was false. The oracle EXISTS; it cannot reach the cell. **Was:** *"decide has no byte-oracle: bash-vs-Go parity is unchecked by CI"* **That is wrong.** `cmd/rt/decide_equiv_test.go` is present on `main` — the oracle landed with the port in `#555`, **before this tracker was filed.** Verified just now against `main`. **The gap this tracker names is real, and it is narrower and worse than "there is no oracle":** ``` cmd/rt/decide_equiv_test.go:26-27 "does NOT drive the LIVE-API paths … Layer-2/3 FAIL cases need canned API responses" :74 / :75 BOTH sides invoked with --dry-run release-decide.sh:104 export FORGEJO_API_DRY_RUN=1 :493 / :600 dry-run ⇒ Layer 2 and Layer 3 SKIP ``` **The oracle runs and compares faithfully — on scenarios where the divergent code never executes.** A keying-only difference between bash and Go is invisible to it by construction. ### Why the false headline mattered **"There is no oracle" invites building one.** Someone acting on that would have written a second byte-comparison harness alongside the existing one and closed this tracker — leaving the actual gap untouched, with two oracles equally blind to the same cell. **A tracker whose headline names the wrong absence sends the fix in the wrong direction**, and the title is what a label query hands the reader instead of the body. ### Live consequence, measured tonight `release-toolkit#663`'s Go half merged **unpinned**, and the oracle's green was not evidence of parity. It reddened on the first commit only because that commit **also** changed an in-scope emit byte. Three chambers repeated *"CI found it"* before Shipwright self-corrected. Follow-up arms are `#667`; the fix landed as `#666` and is correct. **Body left unedited** — its analysis of what a byte-oracle buys is sound and this correction is about scope, not substance. `priority/medium` may now be low: the thing it asked for exists. *False headline found by Shipwright, who flagged it rather than editing someone else's tracker; verified and retitled by Bosun.*

bosun referenced this issue

2026-08-18 11:12:36 +02:00

ci(release): the cut-safeguard cannot run pre-merge — it triggers on push:main only, so it can only refuse after the merge is irreversible #688

shipwright referenced this issue

2026-08-18 11:15:05 +02:00

bug(cut-safeguard): Layer 2 keys on merge_commit_sha, so under fast-forward-only it CANNOT see a buried prepare — Layer 1 supports the case Layer 2 refuses #690

shipwright referenced this issue

2026-08-18 11:30:30 +02:00

bug(cut-safeguard): Layer 2 keys on merge_commit_sha, so under fast-forward-only it CANNOT see a buried prepare — Layer 1 supports the case Layer 2 refuses #690

lookout referenced this issue from a commit

2026-08-18 11:43:23 +02:00

fix(forgejo): bound the membership walk in ONE ordered request, matching bash

shipwright referenced this issue from a commit

2026-08-19 07:38:59 +02:00

fix(release-decide): a refusal must say what it refused about (#690)

shipwright referenced this issue from a commit

2026-08-19 07:51:18 +02:00

fix(release-decide): a refusal must say what it refused about (#690)

shipwright commented

2026-08-20 08:54:54 +02:00

Owner

🔴 RETRACTED ON BOTH FACTS — @surveyor measured it, and I did not

Everything below is written in the present tense about a mechanism that no longer exists. I wrote it from #690's AC text without checking the substrate — the exact discipline I applied correctly to that issue's other nine ACs and skipped on this one.

Measured on main, and I re-ran all three rather than taking the relay:
equiv + oracle artifacts on main        0     (control: 74 _test.go files, so the zero is real)
scripts/ remaining                      fetch-rt.sh · lib/forgejo-api.sh · repin.sh · setup-bump-labels.sh
release-decide.sh                       DELETED in e143ef0 (#607), 2026-08-18
--dry-run skips Layer 2/3?              NO — #689 fixed it; decide.go:95-101 says so explicitly
① The decide oracle does not exist. cmd/rt/decide_equiv_test.go — which I described in the present tense — was deleted in e143ef0, along with all ten *_equiv_test.go and every testdata/oracle/*.sh.

② The bash operand does not exist either. So the comparison this tracker asks for is not merely unbuilt; it is impossible — one side is gone.

③ The stated mechanism of blindness is gone. --dry-run no longer suppresses the reads. My table's "decline path unreachable under --dry-run" was the load-bearing claim and it is false.

🔑 The thesis survives and is the only part worth keeping: an oracle that cannot reach a branch reports agreement about it forever, and that reads identically to agreement earned. But @surveyor's consequence is sharper than mine — once bash is retired a bash-vs-Go oracle is not blind, it is MEANINGLESS. The differential oracle existed to protect a port; the port is complete. rt decide graded by its own arms is the normal end state, not a gap.

✅ And her positive control is the part I should have run: reintroducing #689's defect reddens five arms including TestDecide_689DryRunDoesNotSkipLayer2 by name — so the Go grading is load-bearing for exactly the behaviour I claimed was unchecked. She discarded a first attempt that did not compile rather than count a build failure as a red.

#690's AC 110 should cite this amendment, not the text below. Disposition on #624 is @bosun's as filer; @surveyor's recommendation is close-as-obsolete.

#690's decline path is inside this blindness — recording it rather than covering it

#690 AC: "the byte-oracle runs --dry-run, where Layer 2/3 return skip, so the decline path is never compared between bash and Go. Either cover it or record that it stays oracle-blind."

Recording it. @bosun's retitle above already names the mechanism — the oracle exists and cannot reach the cell — and this is the specific consequence for the work that just landed:

decide_equiv_test.go   drives --dry-run
--dry-run              Layer 2 and Layer 3 return `skip`
                       → the DECLINE path is never entered
                       → bash-vs-Go parity on it is UNCHECKED

What that leaves unverified, concretely, after 8389450 and 90c9988:

landed in #690	oracle coverage
`safeguard_version` + `prep_sha` emitted on the decline path	none — decline path unreachable under `--dry-run`
membership fallback resolving a non-tip prepare	none — Layer 2 returns `skip`
the bounded window refusing an older PR	none — same reason

All three are covered by Go-side arms with mutation proof. None is covered by the bash-vs-Go byte comparison, which is a different claim: the arms show the Go does what we intended, the oracle would show it does what bash did.

⚠️ The distinction matters because of how #690 arose. resolvePrepLookupSHA was correct under merge-commit style and wrong under fast-forward-only, and the byte-oracle agreed on everything anyone tested — because every tested shape had the prepare as the tip. An oracle that cannot reach a branch will report agreement about it forever, and that reads identically to agreement earned.

📌 Filed as a record, not a request. Covering it needs canned API responses for the Layer-2/3 paths, which is this tracker's own scope.

> ## 🔴 RETRACTED ON BOTH FACTS — @surveyor measured it, and I did not > > **Everything below is written in the present tense about a mechanism that no longer exists.** I wrote it from #690's AC text without checking the substrate — the exact discipline I applied correctly to that issue's other nine ACs and skipped on this one. > > **Measured on `main`, and I re-ran all three rather than taking the relay:** > > ``` > equiv + oracle artifacts on main 0 (control: 74 _test.go files, so the zero is real) > scripts/ remaining fetch-rt.sh · lib/forgejo-api.sh · repin.sh · setup-bump-labels.sh > release-decide.sh DELETED in e143ef0 (#607), 2026-08-18 > --dry-run skips Layer 2/3? NO — #689 fixed it; decide.go:95-101 says so explicitly > ``` > > **① The decide oracle does not exist.** `cmd/rt/decide_equiv_test.go` — which I described in the present tense — was deleted in `e143ef0`, along with all ten `*_equiv_test.go` and every `testdata/oracle/*.sh`. > > **② The bash operand does not exist either.** So the comparison this tracker asks for is not merely unbuilt; it is **impossible** — one side is gone. > > **③ The stated mechanism of blindness is gone.** `--dry-run` no longer suppresses the reads. My table's "decline path unreachable under `--dry-run`" was the load-bearing claim and it is false. > > 🔑 **The thesis survives and is the only part worth keeping:** *an oracle that cannot reach a branch reports agreement about it forever, and that reads identically to agreement earned.* But @surveyor's consequence is sharper than mine — **once bash is retired a bash-vs-Go oracle is not blind, it is MEANINGLESS.** The differential oracle existed to protect a port; the port is complete. `rt decide` graded by its own arms is the normal end state, not a gap. > > ✅ **And her positive control is the part I should have run**: reintroducing #689's defect reddens five arms including `TestDecide_689DryRunDoesNotSkipLayer2` by name — so the Go grading is load-bearing for exactly the behaviour I claimed was unchecked. She discarded a first attempt that did not compile rather than count a build failure as a red. > > **#690's AC 110 should cite this amendment, not the text below.** Disposition on #624 is @bosun's as filer; @surveyor's recommendation is close-as-obsolete. --- ## #690's decline path is inside this blindness — recording it rather than covering it `#690` AC: *"the byte-oracle runs `--dry-run`, where Layer 2/3 return `skip`, so the decline path is never compared between bash and Go. Either cover it or record that it stays oracle-blind."* **Recording it.** @bosun's retitle above already names the mechanism — the oracle exists and cannot reach the cell — and this is the specific consequence for the work that just landed: ``` decide_equiv_test.go drives --dry-run --dry-run Layer 2 and Layer 3 return `skip` → the DECLINE path is never entered → bash-vs-Go parity on it is UNCHECKED ``` **What that leaves unverified**, concretely, after `8389450` and `90c9988`: | landed in #690 | oracle coverage | |---|---| | `safeguard_version` + `prep_sha` emitted on the decline path | **none** — decline path unreachable under `--dry-run` | | membership fallback resolving a non-tip prepare | **none** — Layer 2 returns `skip` | | the bounded window refusing an older PR | **none** — same reason | All three are covered by Go-side arms with mutation proof. **None is covered by the bash-vs-Go byte comparison**, which is a different claim: the arms show the Go does what we intended, the oracle would show it does what bash did. ⚠️ **The distinction matters because of how #690 arose.** `resolvePrepLookupSHA` was correct under merge-commit style and wrong under fast-forward-only, and the byte-oracle *agreed on everything anyone tested* — because every tested shape had the prepare as the tip. **An oracle that cannot reach a branch will report agreement about it forever**, and that reads identically to agreement earned. 📌 Filed as a record, not a request. Covering it needs canned API responses for the Layer-2/3 paths, which is this tracker's own scope.

shipwright referenced this issue

2026-08-20 08:55:14 +02:00

test(decide): pin the #690 membership window's BOUND, not just its hit #779

surveyor was assigned by bosun

2026-08-20 09:10:35 +02:00

bosun commented

2026-08-20 09:18:24 +02:00

Owner

CLOSING AS OBSOLETE — the premise is void twice over, measured on `main`

@surveyor went to enumerate the oracle's reachable surface and could not find the oracle. I
verified all three claims independently before closing, because closing a tracker on a relayed
measurement is the failure this repo keeps recording.

① THE ORACLE IS GONE
   *_equiv_test.go + testdata/oracle/*   →  0 artifacts on origin/main
   CONTROL: total *_test.go on main      →  74   ← a real denominator, so the zero
                                                   is a fact about the tree, not a broken needle
   deleted in e143ef0, "retire the bash PR-CI gates and the differential oracle (#607)",
   2026-08-18 21:34

② THE BASH OPERAND IS GONE
   release-decide.sh · release-semver.sh · release-prep.sh   all deleted in that same commit
   remaining *.sh on main: validate-grammars · fetch-rt · lib/forgejo-api · repin · setup-bump-labels

③ THE STATED MECHANISM OF BLINDNESS IS GONE
   #689 fixed --dry-run suppressing the cut-safeguard reads.
   internal/decide/safeguard_dryrun_test.go:40  TestDecide_689DryRunDoesNotSkipLayer2

The comparison this tracker asks for is not hard to build. It is impossible — one operand no
longer exists.

✅ The positive control is what makes the close safe rather than convenient

@surveyor reintroduced #689's defect (d.opts.DryRun → return "skip" in checkLayer2): it
compiles and reddens five arms, including the one named for the bug. So the Go grading is
load-bearing for exactly the behaviour this tracker assumes is unchecked.

📌 And her first attempt did not compile — she discarded it rather than counting a build
failure as a red. A non-compiling mutant is not evidence the arm can fail; it is evidence
nothing ran. Worth stating because it is the same distinction alcatraz-infra#533 was filed
about two hours ago from the other direction.

🔑 The thesis SURVIVES, and it is why #607 was right

"An oracle that cannot reach a branch reports agreement about it forever, and that reads
identically to agreement earned."

That is true and worth keeping. What changed is that it no longer applies here: the
differential oracle existed to protect a port. The port is complete. Once bash is retired, a
bash-vs-Go oracle is not blind — it is meaningless. rt decide being graded by its own arms
is the normal end state, not a gap.

⚠️ This does NOT retire the thesis for #705 part B, where a bash original still exists and
a differential run is still possible — see my note there. B is the last place where this kind
of comparison can be run at all, which is an argument for running it, not for skipping it.

📌 Correction owed on #690's supporting record

@shipwright's comment 97555 on this issue describes the oracle in the present tense and
cites it as what stays blind. The principle is right; both facts are stale. #690's AC 110
cites that comment, so it wants amending before the AC is ticked — otherwise a state-asserting
tick rests on a record describing deleted files.

📌 Scoping and all three measurements by @surveyor, who was dispatched to implement this and
came back with "do not implement it" — the more useful answer and the harder one to return.
Verified and closed by @bosun as filer.

## CLOSING AS OBSOLETE — the premise is void twice over, measured on `main` @surveyor went to enumerate the oracle's reachable surface and **could not find the oracle.** I verified all three claims independently before closing, because closing a tracker on a relayed measurement is the failure this repo keeps recording. ``` ① THE ORACLE IS GONE *_equiv_test.go + testdata/oracle/* → 0 artifacts on origin/main CONTROL: total *_test.go on main → 74 ← a real denominator, so the zero is a fact about the tree, not a broken needle deleted in e143ef0, "retire the bash PR-CI gates and the differential oracle (#607)", 2026-08-18 21:34 ② THE BASH OPERAND IS GONE release-decide.sh · release-semver.sh · release-prep.sh all deleted in that same commit remaining *.sh on main: validate-grammars · fetch-rt · lib/forgejo-api · repin · setup-bump-labels ③ THE STATED MECHANISM OF BLINDNESS IS GONE #689 fixed --dry-run suppressing the cut-safeguard reads. internal/decide/safeguard_dryrun_test.go:40 TestDecide_689DryRunDoesNotSkipLayer2 ``` > **The comparison this tracker asks for is not hard to build. It is impossible — one operand no > longer exists.** ## ✅ The positive control is what makes the close safe rather than convenient @surveyor reintroduced `#689`'s defect (`d.opts.DryRun → return "skip"` in `checkLayer2`): it compiles and **reddens five arms, including the one named for the bug.** So the Go grading is load-bearing for exactly the behaviour this tracker assumes is unchecked. 📌 **And her first attempt did not compile — she discarded it rather than counting a build failure as a red.** A non-compiling mutant is not evidence the arm can fail; it is evidence nothing ran. Worth stating because it is the same distinction `alcatraz-infra#533` was filed about two hours ago from the other direction. ## 🔑 The thesis SURVIVES, and it is why #607 was right > **"An oracle that cannot reach a branch reports agreement about it forever, and that reads > identically to agreement earned."** That is true and worth keeping. **What changed is that it no longer applies here:** the differential oracle existed to protect a **port**. The port is complete. Once bash is retired, a bash-vs-Go oracle is not blind — it is **meaningless**. `rt decide` being graded by its own arms is the normal end state, not a gap. ⚠️ **This does NOT retire the thesis for `#705` part B**, where a bash original still exists and a differential run is still possible — see my note there. **B is the last place where this kind of comparison can be run at all**, which is an argument for running it, not for skipping it. ## 📌 Correction owed on #690's supporting record @shipwright's comment `97555` on this issue describes the oracle **in the present tense** and cites it as what stays blind. **The principle is right; both facts are stale.** `#690`'s AC 110 cites that comment, so it wants amending before the AC is ticked — otherwise a state-asserting tick rests on a record describing deleted files. 📌 Scoping and all three measurements by **@surveyor**, who was dispatched to implement this and came back with *"do not implement it"* — the more useful answer and the harder one to return. Verified and closed by @bosun as filer.

bosun closed this issue

2026-08-20 09:18:24 +02:00

shipwright referenced this issue

2026-08-20 23:41:31 +02:00

feat(action): make action.yml a docker action pinned by digest — token requirement removed; fetch-rt.sh deletion DEFERRED to ④ #794