gate_paths discards a git grep status inside a pipeline that has no reporting channel

[randomparity]

Split out of #63 as a deferred site, and recorded as such in ADR 0008's Consequences.

Problem

check-records.sh's gate_paths ends:

} | while IFS= read -r needle; do
    git grep --no-color -lF "$needle" "$base" -- .github/workflows 2>/dev/null |
      sed 's/^[^:]*://' || true
  done | sort -u

git grep reads external bytes — a ref's worth of workflow files — and its status is discarded by || true. A fault is indistinguishable from "the needle does not appear in any workflow", which is the ordinary answer. The result feeds the gate-file rules, so a fault makes a gate file look unreferenced.

This is the same idiom ADR 0005 and ADR 0008 govern, and #63 converted sixteen sites of it. This one was not converted, for a reason that is about shape rather than risk.

Why it was deferred rather than converted

gate_paths's entire body is a pipeline: a { … } group piped into a while loop piped into sort -u. Every statement in it therefore runs in a subshell, so err/err_full would set failed=1 into a subshell that is discarded — ADR 0005's stated "a scan inside a process substitution has no channel at all". Giving this site a report means restructuring gate_paths so its scanning is not inside a pipeline, not adding a status capture to the existing shape.

Converting it inside #63 would have meant either a restructure materially larger than the sixteen mechanical conversions around it, or inventing the private per-scan protocol ADR 0005 decision 1 explicitly refuses.

Expected

1. gate_paths restructured so a scan fault has a reporting channel — most likely by collecting needles into a variable and running the git grep loop outside a pipeline, the way ADR 0008 decision 6 handles the < <(…) loop sites.
2. The git grep status captured and branched three ways: 0 matched, 1 no match, >= 2 fault.
3. A fault reported with a coded E-*-SCAN diagnostic naming the ref and the status, per the convention Sweep the bare if grep / if rg verdict idiom out of the gate scripts #25/Sweep the grep/rg cmd || true verdict-swallow idiom out of check-records.sh (and siblings) #55/check_not_rewritten and evaluate_base_conformance fail open on an unreadable base blob #64/tracked_in_index collapses a git ls-files fault into 'not tracked' #69/Sweep the pipeline-into-grep verdict idiom, which needs PIPESTATUS not a captured $? #63 established.
4. A regression test with git PATH-stubbed to fault, following the existing convention.
5. Both mirrors (.github/scripts/ ↔ skills/tome-of-lore/assets/) stay byte-identical.

Out of scope

The sixteen sites converted in #63, and the in-memory printf … | grep class that ADR 0005 decision 1 and ADR 0008 decision 4 place outside the rule.

Provenance

Found while reviewing ADR 0008 for #63. Recorded in that record's Consequences as a site remaining outside the sweep, with this issue as its owner.

[randomparity]

Scope — issue #89

• Token: q89-fe38539b
• Scope identity: gate_paths discards a git grep status inside a pipeline that has no reporting channel #89; annotation q89-fe38539b
• Outcome: Make gate_paths distinguish a workflow-search fault from an honest no-match result so the records gate never derives its protected workflow set from an incomplete scan.
• Completion criteria: (1) restructure gate_paths so the git grep scan has a reporting channel; (2) branch on status 0 matched, 1 no match, and >=2 fault; (3) report a coded E-*-SCAN diagnostic naming the ref and status; (4) add a PATH-stubbed git regression test; (5) keep .github/scripts/ and skills/tome-of-lore/assets/ mirrors byte-identical. Source: issue gate_paths discards a git grep status inside a pipeline that has no reporting channel #89 Expected section.
• Provenance: Outcome and all completion criteria come from issue gate_paths discards a git grep status inside a pipeline that has no reporting channel #89. The three-way scan behavior is governed by accepted ADR 0005 decisions 1 and 3, carried forward unchanged by accepted ADR 0024 decision 1 and accepted ADR 0025. The operator requested $quest for issue gate_paths discards a git grep status inside a pipeline that has no reporting channel #89 in this run.
• Exclusions: The sixteen sites converted by issue Sweep the pipeline-into-grep verdict idiom, which needs PIPESTATUS not a captured $? #63 and the in-memory printf ... | grep class are excluded by issue gate_paths discards a git grep status inside a pipeline that has no reporting channel #89; no additional exclusions.
• Surface: .github/scripts/check-records.sh, .github/scripts/check-records-test.sh, their byte-identical mirrors under skills/tome-of-lore/assets/, and .claude-plugin/plugin.json for the required patch version bump. Direct dependencies are the existing records gate helpers and test-fixture conventions.
• Ambiguities: None. The issue supplies the intended restructuring, status behavior, diagnostic content, test mechanism, and mirror constraint.
• Interaction: interactive
• Blast radius: Records-gate protected-path discovery and its mirrored shipped asset; focused regression suite and version manifest.
• Change hazards: Preserving emitted-path semantics and sort/dedup behavior; propagating a scan fault out of a function currently consumed through process substitution; Bash 3.2 compatibility; exact mirror parity.
• Complexity: S
• Decompose verdict: One independently testable slice; do not decompose.
• Classification: governed-small-change
• Governing decision evidence: ADR 0005 is accepted; although its banner points to ADR 0024, ADR 0024 decision 1 explicitly carries decisions 1–3 forward unchanged and withdraws only an unrelated exemption. ADR 0025 is accepted and preserves those decisions. Governed behavior: external-byte scans feeding verdicts must distinguish match, no match, and fault, with the caller reporting the fault.

[randomparity]

Trajectory — issue #89

• Parked phase: Step 5, before Forge workspace setup and before the first failing test.
• Branch: feat/gate-paths-scan-status-89; no pull request.
• Guardrails: Baseline and change guardrails have not run; the branch is clean and contains no implementation changes.
• Human input needed: Choose whether Forge should create an isolated external worktree under the repository's sibling worktree directory or continue in the current checkout.
• Resume: Re-run $quest 89 with the workspace choice; the claim and verified WORK:SCOPE token are q89-fe38539b.

[randomparity]

Trajectory — issue #89

• Resume authorization: The operator replied worktree in the active Codex conversation, authorizing an isolated external worktree for this run.
• Resume phase: Step 5, Forge workspace setup before the first failing test.
• Branch: feat/gate-paths-scan-status-89; no pull request.
• Scope token: q89-fe38539b.