bug(contract-paths-check): once_existed() false-FAILS on a shallow clone (#849 AC6) #903

New issue

Closed

opened 2026-08-26 13:43:33 +02:00 by bosun · 0 comments

bosun commented

2026-08-26 13:43:33 +02:00

Owner

`once_existed()` false-FAILS on a shallow clone — the defect `#849` exists to prevent, through the back door

scripts/contract-paths-check.sh:41-42:

once_existed() {  # a path that does not resolve today: did it EVER?
    git log --oneline -1 --all -- "$1" 2>/dev/null | grep -q .
}

🔴 On a shallow clone, history before the cutoff is absent — so git log --all returns nothing for a path that genuinely existed. The caller then takes the else branch at :76:

NEVER EXISTED — fabricated      FAIL=1

A correct provenance entry is reported as a fabrication, and the check refuses. That is precisely the false-refusal shape this tracker was opened to remove: #849's own motivating defect was a naive check reddening on six sites that were right.

Why it has not bitten yet

✅ The precondition holds where the check currently runs: #849 recorded that 8 workflows in this repo use fetch-depth: 0. So in rt's own CI the history is complete and once_existed() is sound.

⚠️ It is not guaranteed anywhere else — a local run in a shallow clone, an adopter's CI with a default depth, or any future workflow that omits fetch-depth. The check has no idea which world it is in, and reports the same red either way.

What `#849` AC6 asked for and did not get

"The full-history precondition is stated at the point of use, and the check REFUSES rather than skips when history is shallow (#777's C4 corpus test is the precedent — it refuses on an empty corpus rather than skipping)."

Measured on origin/main: zero occurrences of shallow, is-shallow-repository, unshallow, depth or any full-history precondition, in the script or its bats file. The AC is UNFINISHED, not deferred by choice — it was closed along with the rest when #893 merged under a Closes keyword.

Scope

contract-paths-check.sh detects a shallow repository (git rev-parse --is-shallow-repository) before any once_existed() call — DONE — contract-paths-check.sh:62, inside once_existed() before any provenance verdict
On shallow, it exits COULD-NOT-GRADE (2) — never a FAIL and never a silent pass. A provenance claim it cannot check is not a claim it may refuse — DONE — three-state once_existed() (return 0/1/2); :102 renders COULD NOT GRADE — shallow clone, :123 the summary
The precondition is stated in the PASS output, per §Mechanism design: the pass names what it did not check — DONE — :137-143, "This does NOT check: … provenance history absent from a SHALLOW clone — that is could-not-grade (2), not a pass"
A control arm: a deliberately shallow fixture must produce exit 2, and the SAME fixture unshallowed must produce the normal verdict — one variable — DONE — tests/contract-paths-check.bats:106 (shallow→2) and :127 ("the two arms DIFFER on one variable — clone depth, same fixture")
The inverse arm retained: a genuinely fabricated path must still FAIL on a full clone, so the shallow guard does not make the check unfailable — DONE — :118, "FULL clone: a fabricated path STILL FAILS". Suite green on main.

⚠️ The last two are a pair. Adding a could-not-grade branch is exactly the change that can swallow real failures — a guard that returns 2 on everything passes every suite while checking nothing.

Anchor

Found by an AC sweep of #849 after it was closed by keyword on #893's merge, at the operator's prompting. Nine of its ten open ACs verified against main; this one did not. Closes #N shuts a tracker without ticking its ACs (#848), so the gap was invisible until someone re-derived them. Filed by @bosun; the check and the other nine ACs are @surveyor's.

## `once_existed()` false-FAILS on a shallow clone — the defect `#849` exists to prevent, through the back door `scripts/contract-paths-check.sh:41-42`: ```sh once_existed() { # a path that does not resolve today: did it EVER? git log --oneline -1 --all -- "$1" 2>/dev/null | grep -q . } ``` 🔴 **On a shallow clone, history before the cutoff is absent — so `git log --all` returns nothing for a path that genuinely existed.** The caller then takes the else branch at `:76`: ``` NEVER EXISTED — fabricated FAIL=1 ``` **A correct provenance entry is reported as a fabrication, and the check refuses.** That is precisely the false-refusal shape this tracker was opened to remove: `#849`'s own motivating defect was a naive check reddening on six sites that were right. ## Why it has not bitten yet ✅ **The precondition holds where the check currently runs**: `#849` recorded that 8 workflows in this repo use `fetch-depth: 0`. So in rt's own CI the history is complete and `once_existed()` is sound. ⚠️ **It is not guaranteed anywhere else** — a local run in a shallow clone, an adopter's CI with a default depth, or any future workflow that omits `fetch-depth`. **The check has no idea which world it is in, and reports the same red either way.** ## What `#849` AC6 asked for and did not get > *"The full-history precondition is stated at the point of use, and the check REFUSES rather than skips when history is shallow (`#777`'s C4 corpus test is the precedent — it refuses on an empty corpus rather than skipping)."* **Measured on `origin/main`: zero occurrences of `shallow`, `is-shallow-repository`, `unshallow`, `depth` or any full-history precondition, in the script or its bats file.** The AC is UNFINISHED, not deferred by choice — it was closed along with the rest when `#893` merged under a `Closes` keyword. ## Scope - [x] `contract-paths-check.sh` detects a shallow repository (`git rev-parse --is-shallow-repository`) before any `once_existed()` call — **DONE** — `contract-paths-check.sh:62`, inside `once_existed()` before any provenance verdict - [x] On shallow, it exits **COULD-NOT-GRADE (2)** — never a FAIL and never a silent pass. A provenance claim it cannot check is not a claim it may refuse — **DONE** — three-state `once_existed()` (`return 0/1/2`); `:102` renders `COULD NOT GRADE — shallow clone`, `:123` the summary - [x] The precondition is stated in the PASS output, per §*Mechanism design*: the pass names what it did not check — **DONE** — `:137-143`, *"This does NOT check: … provenance history absent from a SHALLOW clone — that is could-not-grade (2), not a pass"* - [x] A control arm: a deliberately shallow fixture must produce exit 2, and the SAME fixture unshallowed must produce the normal verdict — one variable — **DONE** — `tests/contract-paths-check.bats:106` (shallow→2) and `:127` (*"the two arms DIFFER on one variable — clone depth, same fixture"*) - [x] The inverse arm retained: a genuinely fabricated path must still FAIL on a full clone, so the shallow guard does not make the check unfailable — **DONE** — `:118`, *"FULL clone: a fabricated path STILL FAILS"*. Suite green on `main`. ⚠️ **The last two are a pair.** Adding a could-not-grade branch is exactly the change that can swallow real failures — a guard that returns 2 on everything passes every suite while checking nothing. ## Anchor Found by an AC sweep of `#849` after it was closed by keyword on `#893`'s merge, at the operator's prompting. **Nine of its ten open ACs verified against `main`; this one did not.** `Closes #N` shuts a tracker without ticking its ACs (`#848`), so the gap was invisible until someone re-derived them. Filed by @bosun; the check and the other nine ACs are @surveyor's.

bosun added the

priority/medium

size/S

kind/bug

labels

2026-08-26 13:43:33 +02:00

bosun referenced this issue

2026-08-26 13:43:55 +02:00

feat(contracts): split byte-authority from provenance so a dead-path check becomes possible (#830 AC4) #849