Repository navigation
Conversation
Mechanism drill, not for merge. HEAD rewrites `scripts/ci-ok.mjs` to exit 0 and adds a deliberate type error under `src/`. A pull request that judged itself would report `ci-ok` green; the base-tree evaluator must report it red because `typecheck` failed, and the log must name the base blob rather than this one. Refs #640
Every evaluator that decides whether a pull request may merge was executed from the pull request's own checkout, so a T3 diff could edit the code that judges it. `review-gate` and `pr-lint` already checked the base ref out; the aggregate and supply-chain gates did not. `ci-ok`, `changes`, `risk`, `action-pins`, `workflow-lint` (the workflow-injection scanner), `codeql-required` and the CodeQL result gate now check the base branch out into `base/` and run `node base/scripts/<gate>.mjs`. Only the data under test comes from the head: the diff (`--repo .`), the workflow files, and the SARIF the analysis produced. The CodeQL baseline and the workflow-injection allowlist are read from `base/`, so a pull request cannot widen either. The `changes` job also runs `scripts/gate-integrity.mjs`, which writes every gate file in the diff into the job summary and fails closed when the diff cannot be read. Not moved: for a `pull_request` event GitHub fetches the workflow YAML from the pull request, so a job's own `run:` lines are the head's text. That shape is covered by the required check plus a T3 PASS on a diff the summary names; a `workflow_run` aggregate is a separate slice. Fixes #640
Owner
Author
|
Record only — do not merge. Mechanism probe for the #640 gate change; its evidence is recorded in #836's body. The branch is the negative control: The branch stays as the record. Only the owner closes this pull request. Written-by: Fledge Platform Dev-1 |
The first CI run on this branch failed in `changes`: the base branch (43210cf) predates `scripts/gate-integrity.mjs`, so `node base/scripts/gate-integrity.mjs` was MODULE_NOT_FOUND on the pull request that introduces the file. The step now tests the base path, `[ -f base/scripts/gate-integrity.mjs ]`, and writes a notice when it is absent. The guard reads the base tree, so a diff cannot decide whether the summary runs; once the file is on `main` every later pull request gets the summary. `test/gateBaseTree.test.ts` pins the base path, and `docs/autonomous-dev.md` says why the guard exists. Refs #640
A reviewer reading a run log could not tell which copy of `ci-ok` produced the verdict: the base checkout is a second directory, and the branch's own copy of the file still sits at the root. `ci-ok` now prints the blob the base tree holds for `scripts/ci-ok.mjs` before it runs it, so the sha in the log names the file the verdict came from, and a branch that rewrites the evaluator shows up as a mismatch in its own run. `docs/autonomous-dev.md` records the line and says it is evidence, not a gate. Refs #640
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Written-by: HugoXK
No-issue: mechanism probe for the #640 gate change; not for merge.
DO NOT MERGE. This pull request is the negative control the issue review asked for: it shows, in a live run, that the merge gate ignores a branch's own copy of its evaluator. Only the owner closes it.
Tip:
3afe696118b181841bdb2146ef90a39f73b8811b, tree1e58d87fa966dcbc6668e33297a0546151c8b289.What the branch does: rewrites
scripts/ci-ok.mjstoprocess.exit(0)and addssrc/probe-base-tree.tswith a deliberate type error.What a correct gate does with it:
ci-okruns the base tree's copy, names that copy by blob sha in the log, and fails becausetypecheckfailed. A gate that read the branch copy would reportci-okgreen over a red branch, which is the defect the #640 change removes.Ran:
Not run:
npm run checkon this branch, for the same reason:typecheckcannot pass with the type error the branch adds.Risk and rollback:
scripts/ci-ok.mjsis T3 by the risk rules, which is why this is a labelled probe and not a product change. Rollback is deleting theprobe/640-base-treebranch; nothing onmaindepends on it.Docs-not-needed: the branch is deleted after the demonstration and changes no product surface.
Changelog-not-needed: a mechanism probe is not a user-visible change.
maintainer_can_modify: true