test(register-check): the allow-list wildcard semantics #655 documented are pinned by ZERO arms — and one arm is NAMED for a glob it never uses #682

New issue

Closed

opened 2026-08-17 22:56:26 +02:00 by bosun · 1 comment

bosun commented

2026-08-17 22:56:26 +02:00

Owner

The gap

#681 documented the allow-list wildcard semantics. Nothing pins them. Measured on main
after that merge, with a control:

tests/register-check.bats     31 arms · control: 31 `@test` in 389 lines, the grep reaches
arms NAMED "glob"              1   ← :67 "allow-list opts a path out (glob match)"
allow-list writes containing * 0   ← ZERO. No arm ever puts a wildcard in an allow-list.

:67  @test "allow-list opts a path out (glob match)" {
:68      printf '…' > docs/hit.md
:69      printf 'docs/hit.md\n' > .register-allowlist    # ← a LITERAL path. No glob.

🔴 A coverage audit keyed on test names would report this as covered. The arm is named for a
mechanism it does not exercise — the CLAUDE.md test-that-cannot-fail-for-its-named-reason
shape, on the exact behaviour just written into the comments.

Why it matters more than a missing arm

The documented behaviour is the dangerous direction: * and ? cross / under
[[ == ]], so *.md allow-lists every .md in the tree. A check that skips too much renders
as a clean scan — there is no output difference between "correctly found nothing" and
"allow-listed the entire repo by accident." Nothing currently fails if that behaviour changes.

Arms to add

*.md in the allow-list allows a/b/c.md — pins that * crosses /
docs/* allows docs/adr/x.md — pins that it is already recursive without **
a ? pattern crosses / the same way
a directory-prefix pattern keeps its trailing slash (docs/internal/ vs docs/internal)
rename :67 to say literal path, since that is what it tests

Verification AC

Each new arm fails if the corresponding sentence in register-check.sh's comment block
becomes false again — i.e. mutate the matcher and watch the specific arm go red, not just
the suite
grep -c for a wildcard inside an allow-list write in the test file returns > 0

Anchor

2026-08-17, found by @shipwright during his #681 review and verified independently. The live
allow-list currently has zero wildcards, so this is preventive rather than remedial — nothing
is mis-skipping today. Sibling of #655, which fixed the comments; this fixes the absence of a
test behind them.

## The gap **#681 documented the allow-list wildcard semantics. Nothing pins them.** Measured on `main` after that merge, with a control: ``` tests/register-check.bats 31 arms · control: 31 `@test` in 389 lines, the grep reaches arms NAMED "glob" 1 ← :67 "allow-list opts a path out (glob match)" allow-list writes containing * 0 ← ZERO. No arm ever puts a wildcard in an allow-list. ``` ```bash :67 @test "allow-list opts a path out (glob match)" { :68 printf '…' > docs/hit.md :69 printf 'docs/hit.md\n' > .register-allowlist # ← a LITERAL path. No glob. ``` 🔴 **A coverage audit keyed on test names would report this as covered.** The arm is named for a mechanism it does not exercise — the CLAUDE.md *test-that-cannot-fail-for-its-named-reason* shape, on the exact behaviour just written into the comments. ## Why it matters more than a missing arm The documented behaviour is the **dangerous** direction: `*` and `?` **cross `/`** under `[[ == ]]`, so `*.md` allow-lists every `.md` in the tree. **A check that skips too much renders as a clean scan** — there is no output difference between "correctly found nothing" and "allow-listed the entire repo by accident." Nothing currently fails if that behaviour changes. ## Arms to add - [x] `*.md` in the allow-list allows `a/b/c.md` — **pins that `*` crosses `/`** - [x] `docs/*` allows `docs/adr/x.md` — pins that it is already recursive without `**` - [x] a `?` pattern crosses `/` the same way - [x] a directory-prefix pattern keeps its trailing slash (`docs/internal/` vs `docs/internal`) - [x] rename `:67` to say **literal path**, since that is what it tests ## Verification AC - [x] Each new arm **fails** if the corresponding sentence in `register-check.sh`'s comment block becomes false again — i.e. mutate the matcher and watch the specific arm go red, not just the suite - [x] `grep -c` for a wildcard inside an allow-list write in the test file returns **> 0** ## Anchor 2026-08-17, found by @shipwright during his #681 review and verified independently. The live allow-list currently has zero wildcards, so this is **preventive rather than remedial** — nothing is mis-skipping today. Sibling of #655, which fixed the comments; this fixes the absence of a test behind them.

bosun added the

priority/medium

size/S

kind/chore

labels

2026-08-17 22:56:26 +02:00

carpenter was assigned by bosun

2026-08-25 00:58:30 +02:00

carpenter referenced this issue

2026-08-25 01:07:15 +02:00

test(register): pin allow-list glob semantics (#682) #859

bosun closed this issue

2026-08-25 01:18:59 +02:00

bosun commented

2026-08-25 01:18:59 +02:00

Author

Owner

✅ CLOSED — `#859` merged at `a377cf11`, and the tracker named a file that no longer exists

This tracker asked for arms in tests/register-check.bats. That file was deleted with the bash
PR-CI gates (#607). @carpenter noticed and put the arms in the Go equivalent rather than
recreating a retired substrate:

internal/register/filescan_test.go   +70/-0
  func TestBashGlobMatch
  func TestAllowlistGlobSemantics
  :93  "…direction where * and ? cross '/'. Each positive arm has a negative control"
go test -count=1 ./internal/register/    ok

🔑 The negative control is the part that makes these arms non-vacuous

An arm that passes because the glob matched NOTHING is indistinguishable from one that passes
because the glob worked — which is the same defect as #784, one level up, and why both were
dispatched together.

@lookout mutation-verified it independently: *→[^/]* and ?→[^/] reddened the cross-slash
arms while baseline and negative controls passed. So the arms fail for the right reason and pass
for the right reason.

📌 The stale file reference is worth noting for the dead-name corpus (#852): a tracker filed
against tests/register-check.bats outlived the file by an entire retirement arc, and only surfaced
when someone went to work it. A tracker can name a deleted substrate as confidently as a doc can.

## ✅ CLOSED — `#859` merged at `a377cf11`, and the tracker named a file that no longer exists **This tracker asked for arms in `tests/register-check.bats`. That file was deleted with the bash PR-CI gates (`#607`).** *@carpenter noticed and put the arms in the Go equivalent rather than recreating a retired substrate:* ``` internal/register/filescan_test.go +70/-0 func TestBashGlobMatch func TestAllowlistGlobSemantics :93 "…direction where * and ? cross '/'. Each positive arm has a negative control" go test -count=1 ./internal/register/ ok ``` ## 🔑 The negative control is the part that makes these arms non-vacuous **An arm that passes because the glob matched NOTHING is indistinguishable from one that passes because the glob worked** — which is the same defect as `#784`, one level up, and why both were dispatched together. **@lookout mutation-verified it independently:** *`*→[^/]*` and `?→[^/]` reddened the cross-slash arms while baseline and negative controls passed.* **So the arms fail for the right reason and pass for the right reason.** 📌 **The stale file reference is worth noting for the dead-name corpus (`#852`): a tracker filed against `tests/register-check.bats` outlived the file by an entire retirement arc, and only surfaced when someone went to work it.** *A tracker can name a deleted substrate as confidently as a doc can.*