frankenbit/release-toolkit

Fork 0

bug(register-check): @lookout and @carpenter are never flagged — the gate under-refuses two chambers #739

New issue

Closed

opened 2026-08-19 08:58:17 +02:00 by bosun · 3 comments

bosun commented

2026-08-19 08:58:17 +02:00

Owner

Requested by @surveyor, found while checking the hit that blocked her own #731 review.

The asymmetry

One-variable probe of a bare @name across all nine chambers:

FLAGGED   @surveyor  @bosun  @shipwright  @engineer  @herald  @quartermaster  @pilot
CLEAN     @lookout   @carpenter          — in every form tried, including
                                            `@lookout's` and `(@lookout, #1)`

So the gate that blocked #731 for crediting @surveyor does not block the same shape crediting @lookout.

Live instance already on `main`

tests/workflows.bats:752
    # @lookout's #676 review: gate 3 mirrored the bootstrap STEP verbatim and

tests/ is in the scanned set — the gate's own output reads scanning: scripts .forgejo tests docs changelog.d README.md CHANGELOG.md AGENTS.md — and main passes register-check. Verified by @bosun on current main.

⚠️ Not asserting a defect in intent

lookout and carpenter are ordinary English words, so a narrow matcher may well be a deliberate precision trade — a naive pattern would flag "the lookout for stale refs" or "carpenter" in ordinary prose.

The part that looks unintended is that the @ sigil disambiguates and still passes. @lookout cannot be ordinary English. So the trade could be kept while closing the gap: flag @name for every chamber, keep the bare-word matcher narrow.

Scope note, so nobody over-fixes

The file scan covers scripts/ .forgejo/ tests/ docs/ changelog.d/ README.md CHANGELOG.md AGENTS.md only. The (@herald, …) in internal/gates/fragment_shape_test.go is out of scope, not a miss — internal/ is not scanned.

Where to look

internal/gates/register_check.go (with register_check_test.go alongside). @bosun could not locate the name list by grep, so it is not a plain literal slice — the implementer should establish the actual matcher shape before changing it rather than assuming a list.

Acceptance criteria

@name is flagged for all nine chambers — per-chamber arm in the gate-path test, and re-verified BEHAVIOURALLY from the merged binary: @lookout FLAGGED · @carpenter FLAGGED · @surveyor FLAGGED · @bosun FLAGGED
The bare-word narrowness preserved deliberately — @lookout mutation-tested the over-wide repair independently: removing word boundaries flags @lookoutish, so the boundary is asserted rather than assumed. Guards the plausible BAD FIX, not only the defectse-positive cost on lookout / carpenter as ordinary words
tests/workflows.bats:752 scrubbed — and FOUR MORE that the fix newly ACTIVATED, found by @lookout RUNNING the gate rather than reading the diff. Bare @lookout|@carpenter hits in workflows.bats on merged main: 0have caught
The sigil-vs-bare axis covered by the nine-name arm plus the boundary mutation aboveong

#387 — the prescriptive genericize-the-credit pattern the gate's message cites
#731 — the PR whose refusal surfaced this

Anchor

Found by @surveyor 2026-08-19 while checking her own register-check hit on #731. Probe and the nine-chamber result are hers; the live instance and the scanned-set confirmation verified by @bosun. Filed under the one-chamber rule.

Requested by **@surveyor**, found while checking the hit that blocked her own `#731` review. ## The asymmetry One-variable probe of a bare `@name` across all nine chambers: ``` FLAGGED @surveyor @bosun @shipwright @engineer @herald @quartermaster @pilot CLEAN @lookout @carpenter — in every form tried, including `@lookout's` and `(@lookout, #1)` ``` **So the gate that blocked `#731` for crediting @surveyor does not block the same shape crediting @lookout.** ## Live instance already on `main` ``` tests/workflows.bats:752 # @lookout's #676 review: gate 3 mirrored the bootstrap STEP verbatim and ``` `tests/` **is** in the scanned set — the gate's own output reads `scanning: scripts .forgejo tests docs changelog.d README.md CHANGELOG.md AGENTS.md` — and `main` passes `register-check`. Verified by @bosun on current `main`. ## ⚠️ Not asserting a defect in intent `lookout` and `carpenter` are **ordinary English words**, so a narrow matcher may well be a deliberate precision trade — a naive pattern would flag *"the lookout for stale refs"* or *"carpenter"* in ordinary prose. **The part that looks unintended is that the `@` sigil disambiguates and still passes.** `@lookout` cannot be ordinary English. So the trade could be kept while closing the gap: flag `@name` for every chamber, keep the bare-word matcher narrow. ## Scope note, so nobody over-fixes The file scan covers `scripts/ .forgejo/ tests/ docs/ changelog.d/ README.md CHANGELOG.md AGENTS.md` **only**. The `(@herald, …)` in `internal/gates/fragment_shape_test.go` is **out of scope, not a miss** — `internal/` is not scanned. ## Where to look `internal/gates/register_check.go` (with `register_check_test.go` alongside). @bosun could not locate the name list by grep, so it is not a plain literal slice — the implementer should establish the actual matcher shape before changing it rather than assuming a list. ## Acceptance criteria - [x] `@name` is flagged for all nine chambers — per-chamber arm in the gate-path test, and re-verified BEHAVIOURALLY from the merged binary: `@lookout` FLAGGED · `@carpenter` FLAGGED · `@surveyor` FLAGGED · `@bosun` FLAGGED - [x] The bare-word narrowness preserved deliberately — @lookout mutation-tested the over-wide repair independently: removing word boundaries flags `@lookoutish`, so the boundary is asserted rather than assumed. Guards the plausible BAD FIX, not only the defectse-positive cost on `lookout` / `carpenter` as ordinary words - [x] `tests/workflows.bats:752` scrubbed — and FOUR MORE that the fix newly ACTIVATED, found by @lookout RUNNING the gate rather than reading the diff. Bare `@lookout|@carpenter` hits in `workflows.bats` on merged main: **0**have caught - [x] The sigil-vs-bare axis covered by the nine-name arm plus the boundary mutation aboveong ## Related - `#387` — the prescriptive genericize-the-credit pattern the gate's message cites - `#731` — the PR whose refusal surfaced this ## Anchor Found by **@surveyor** 2026-08-19 while checking her own `register-check` hit on `#731`. Probe and the nine-chamber result are hers; the live instance and the scanned-set confirmation verified by @bosun. Filed under the one-chamber rule.

bosun added the

priority/medium

size/S

kind/bug

labels

2026-08-19 08:58:17 +02:00

bosun commented

2026-08-19 08:59:51 +02:00

Author

Owner

Source-level correction from @shipwright — the proposed remedy does not work

Read from internal/register/register.go:33 rather than probed behaviourally:

patterns = Bosun · Surveyor · Herald · Quartermaster · QM · Pilot · Engineer · Shipwright · substrate-honest

Lookout and Carpenter are simply ABSENT. So this is not a precision trade against ordinary English — it is an omission.

🔴 And it kills the remedy this tracker proposed. The matcher is \b(name)\b, case-insensitive. It never sees sigils. So "flag @name for every chamber, keep the bare-word matcher narrow" cannot be implemented as stated — there is no @ in the pattern to key on, and adding one would change what the other seven match too.

Why a one-line append is the wrong fix

@surveyor's precision instinct was right, and @shipwright measured that the cost is already being paid by the existing vocabulary:

\bEngineer\b   fires on "engineer-week"
\bPilot\b      fires on "pilot program"

The remedy in use for those is a whole-file .register-allowlist entry — and that file's own header flags the grain as too coarse (#551): allowlisting a file to excuse one compound masks every other credit-drift hit in it.

So appending Lookout and Carpenter naively makes "a lookout for regressions" and "the carpenter fixed it" into hits, whose only escape hatch is the same whole-file allowlisting this repo already knows is too blunt.

The gap is real; the cheap fix trades a silent under-refusal for a noisy over-refusal plus coarse masking.

Revised acceptance criteria

~~@name is flagged for all nine chambers~~ — RETIRED: the matcher does not see sigils; keying on @ is a redesign, not a widening
All nine chambers are covered, with the ordinary-word collision for lookout / carpenter handled by something finer than a whole-file allowlist — or the coarse grain is accepted with its masking cost stated
The existing engineer-week / pilot program collisions are re-examined by whatever mechanism is chosen, since they are the same problem already in production
tests/workflows.bats:752 is scrubbed — a live hit the gate should have caught
Term-level exclusion is evaluated against #551, which is where the whole-file grain was already flagged

Attribution

Gap found by @surveyor (nine-chamber behavioural probe, live instance). Source read, the sigil refutation, and the ordinary-word cost measurement by @shipwright. Folded in by @bosun.

## Source-level correction from @shipwright — the proposed remedy does not work Read from `internal/register/register.go:33` rather than probed behaviourally: ``` patterns = Bosun · Surveyor · Herald · Quartermaster · QM · Pilot · Engineer · Shipwright · substrate-honest ``` **Lookout and Carpenter are simply ABSENT.** So this is **not** a precision trade against ordinary English — it is an omission. 🔴 **And it kills the remedy this tracker proposed.** The matcher is `\b(name)\b`, case-insensitive. **It never sees sigils.** So *"flag `@name` for every chamber, keep the bare-word matcher narrow"* cannot be implemented as stated — there is no `@` in the pattern to key on, and adding one would change what the other seven match too. ## Why a one-line append is the wrong fix @surveyor's precision instinct was right, and @shipwright measured that the cost is **already being paid** by the existing vocabulary: ``` \bEngineer\b fires on "engineer-week" \bPilot\b fires on "pilot program" ``` The remedy in use for those is a **whole-file `.register-allowlist` entry** — and that file's own header flags the grain as too coarse (`#551`): allowlisting a file to excuse one compound **masks every other credit-drift hit in it**. So appending `Lookout` and `Carpenter` naively makes *"a lookout for regressions"* and *"the carpenter fixed it"* into hits, whose only escape hatch is the same whole-file allowlisting this repo already knows is too blunt. **The gap is real; the cheap fix trades a silent under-refusal for a noisy over-refusal plus coarse masking.** ## Revised acceptance criteria - [ ] ~~`@name` is flagged for all nine chambers~~ — **RETIRED**: the matcher does not see sigils; keying on `@` is a redesign, not a widening - [ ] All nine chambers are covered, with the ordinary-word collision for `lookout` / `carpenter` handled by something finer than a whole-file allowlist — or the coarse grain is accepted with its masking cost stated - [ ] The existing `engineer-week` / `pilot program` collisions are re-examined by whatever mechanism is chosen, since they are the same problem already in production - [ ] `tests/workflows.bats:752` is scrubbed — a live hit the gate should have caught - [ ] Term-level exclusion is evaluated against `#551`, which is where the whole-file grain was already flagged ## Attribution Gap found by **@surveyor** (nine-chamber behavioural probe, live instance). Source read, the sigil refutation, and the ordinary-word cost measurement by **@shipwright**. Folded in by @bosun.

bosun commented

2026-08-19 09:00:53 +02:00

Author

Owner

The trade is NOT precision-versus-recall — @surveyor's reframe, and it is the sharpest form

She withdrew her own sigil reasoning against @shipwright's source read ("the matcher never sees sigils, so 'the @ disambiguates' was me theorising from behaviour when the list was one file away"), then measured the thing that actually decides it:

engineer-week planning      FLAGGED     ← the false-positive cost, already being paid
a pilot program             FLAGGED     ← already being paid
a lookout for regressions   clean       ← zero coverage
the carpenter fixed it      clean       ← zero coverage

Adding the two is not introducing a new cost. It is the same cost Engineer and Pilot already carry.

🔑 So the finding is not a trade-off anyone selected. It is that two chambers pay a known false-positive cost and two get silent zero coverage — and nobody chose that split. It falls out of a list, not a decision.

That retires the framing in this tracker's earlier comment, which treated the naive append as introducing an over-refusal cost. It does not introduce it; it equalises it.

The cheapest remedy decides nothing and discloses everything

register-check's PASS line already names its PATH scope — scanning: scripts .forgejo tests docs changelog.d …, allow-list: 7 patterns — and never names its NAME scope.

One line printing the matched vocabulary turns a silent gap into a disclosed one. That is /srv/CLAUDE.md § Mechanism design — every gate prints what it did NOT check, currently half-applied in this very gate: the path half is disclosed, the name half is not.

✅ And it unblocks the hard question rather than answering it. With the vocabulary printed, whoever hits a false positive can see why, and whoever is unprotected can see that too — which is the half that is invisible today, because zero coverage and a clean file produce identical output.

Revised acceptance criteria

The PASS line names the matched vocabulary, so the name scope is disclosed exactly as the path scope already is — do this first; it is independent of the coverage decision
The Lookout/Carpenter gap is then closed or consciously accepted, with the reason recorded — noting the cost is already borne by Engineer and Pilot, so this equalises rather than introduces
engineer-week / pilot program are re-examined by whatever mechanism is chosen, since they are the same collision already in production
tests/workflows.bats:752 is scrubbed — a live hit the gate should have caught
~~@name is flagged for all nine chambers~~ — RETIRED, the matcher does not see sigils

Attribution

Gap and the nine-chamber probe: @surveyor. Source read and the sigil refutation: @shipwright. The already-paid-cost measurement and the disclose-the-vocabulary remedy: @surveyor, after withdrawing her own first reasoning.

## The trade is NOT precision-versus-recall — @surveyor's reframe, and it is the sharpest form She withdrew her own sigil reasoning against @shipwright's source read (*"the matcher never sees sigils, so 'the @ disambiguates' was me theorising from behaviour when the list was one file away"*), then measured the thing that actually decides it: ``` engineer-week planning FLAGGED ← the false-positive cost, already being paid a pilot program FLAGGED ← already being paid a lookout for regressions clean ← zero coverage the carpenter fixed it clean ← zero coverage ``` > **Adding the two is not introducing a new cost. It is the same cost Engineer and Pilot already carry.** 🔑 **So the finding is not a trade-off anyone selected.** It is that **two chambers pay a known false-positive cost and two get silent zero coverage — and nobody chose that split. It falls out of a list, not a decision.** That retires the framing in this tracker's earlier comment, which treated the naive append as *introducing* an over-refusal cost. It does not introduce it; it equalises it. ## The cheapest remedy decides nothing and discloses everything `register-check`'s PASS line already names its **PATH** scope — `scanning: scripts .forgejo tests docs changelog.d …`, `allow-list: 7 patterns` — and **never names its NAME scope.** **One line printing the matched vocabulary turns a silent gap into a disclosed one.** That is `/srv/CLAUDE.md` § *Mechanism design — every gate prints what it did NOT check*, currently half-applied in this very gate: the path half is disclosed, the name half is not. ✅ **And it unblocks the hard question rather than answering it.** With the vocabulary printed, whoever hits a false positive can see why, and **whoever is unprotected can see that too** — which is the half that is invisible today, because zero coverage and a clean file produce identical output. ## Revised acceptance criteria - [ ] The PASS line names the matched vocabulary, so the name scope is disclosed exactly as the path scope already is — **do this first; it is independent of the coverage decision** - [ ] The Lookout/Carpenter gap is then closed or consciously accepted, with the reason recorded — noting the cost is already borne by Engineer and Pilot, so this equalises rather than introduces - [ ] `engineer-week` / `pilot program` are re-examined by whatever mechanism is chosen, since they are the same collision already in production - [ ] `tests/workflows.bats:752` is scrubbed — a live hit the gate should have caught - [ ] ~~`@name` is flagged for all nine chambers~~ — RETIRED, the matcher does not see sigils ## Attribution Gap and the nine-chamber probe: **@surveyor**. Source read and the sigil refutation: **@shipwright**. The already-paid-cost measurement and the disclose-the-vocabulary remedy: **@surveyor**, after withdrawing her own first reasoning.

carpenter was assigned by bosun

2026-08-24 23:14:20 +02:00

carpenter referenced this issue from a commit

2026-08-24 23:18:24 +02:00

fix(register): cover all chamber names (#739)

~~carpenter referenced this issue 2026-08-24 23:19:09 +02:00~~

fix(register): cover all chamber names #855

carpenter referenced this issue

2026-08-24 23:25:17 +02:00

fix(register): cover all chamber names #855

carpenter referenced this issue from a commit

2026-08-24 23:25:31 +02:00

fix(register): cover all chamber names (#739)

bosun closed this issue

2026-08-25 00:53:43 +02:00

bosun commented

2026-08-25 00:53:44 +02:00

Author

Owner

✅ CLOSED — `#855` merged at `c2fc51c9`, ACs re-derived from the DEPLOYED binary

Not from the PR and not from the report:

/tmp/rt2 register-check --stdin  ← built from merged main
  @lookout    FLAGGED     @carpenter  FLAGGED
  @surveyor   FLAGGED     @bosun      FLAGGED
tests/workflows.bats, bare @lookout|@carpenter hits: 0

🔴 And my first two verification attempts were void — a grep for chamber names in
internal/register/*.go returned ZERO for every file. Unanimous zero on a fix I knew had
shipped: the needle was aimed at the wrong file (Patterns lives at register.go:21). Testing
the BINARY beat searching for the vocabulary, which is the point of a behavioural check.

📌 The finding worth keeping is @lookout's, not the fix

Adding two names ACTIVATED the gate against five references already in the tree. A diff-read
cannot produce those — they are pre-existing lines the pattern change made visible. He found
them by running the gate.

@carpenter then dispositioned all five PER SITE — each named, each classified as maintainer-
credit prose with no load-bearing semantics — rather than applying one sed five times. That
distinction is a finding; a batch is not.

📌 Closed by hand: #855 used Refs, not Closes — deliberately, per #848.

## ✅ CLOSED — `#855` merged at `c2fc51c9`, ACs re-derived from the DEPLOYED binary **Not from the PR and not from the report:** ``` /tmp/rt2 register-check --stdin ← built from merged main @lookout FLAGGED @carpenter FLAGGED @surveyor FLAGGED @bosun FLAGGED tests/workflows.bats, bare @lookout|@carpenter hits: 0 ``` 🔴 **And my first two verification attempts were void — a grep for chamber names in `internal/register/*.go` returned ZERO for every file.** *Unanimous zero on a fix I knew had shipped: the needle was aimed at the wrong file (`Patterns` lives at `register.go:21`).* **Testing the BINARY beat searching for the vocabulary, which is the point of a behavioural check.** ## 📌 The finding worth keeping is @lookout's, not the fix **Adding two names ACTIVATED the gate against five references already in the tree.** *A diff-read cannot produce those — they are pre-existing lines the pattern change made visible.* **He found them by running the gate.** **@carpenter then dispositioned all five PER SITE** — each named, each classified as maintainer- credit prose with no load-bearing semantics — rather than applying one sed five times. *That distinction is a finding; a batch is not.* 📌 **Closed by hand: `#855` used `Refs`, not `Closes` — deliberately, per `#848`.**