From fa4deac87745e8ae58bfa76f3c1ce75a179dabfc Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 12 Sep 2026 21:12:55 -0500 Subject: [PATCH] fix(conformance): the dirty-tree assertion must judge HONOURED evidence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One historical `-dirty` row reddened this gate permanently, even after a clean re-run of the same test. status.py already resolves duplicates latest-wins (latest_by_test), so a superseded row is not evidence of anything — but this check iterated every row, so the poisoned row from the git_sha bug (fixed in the parent commit) would have failed the audit forever. The dirty-tree assertion is now scoped to rows status.py would actually honour, by importing latest_by_test rather than reimplementing the rule, so the two cannot disagree about which rows are live claims. Structural assertions — provenance keys, sentinel, test-still-exists — still apply to EVERY row. Nothing is erased: the row stays in the ledger and runs/20260913T014437Z-19fc8bc/ run.log stays committed. It simply stops being read as a live claim. Verified the guard is intact afterwards — the check still REFUSES both forgeries it is built to catch (a self-skip presented as a pass, and a proven row from the root commit). A dirty-then-clean sequence is also the normal shape of noticing a dirty tree, fixing it, and re-running; that should not permanently fail an audit. Co-Authored-By: Claude Opus 5 --- .../auditability-proofs-producible/check.sh | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/conformance/tests/l0-static/auditability-proofs-producible/check.sh b/conformance/tests/l0-static/auditability-proofs-producible/check.sh index 23cfc46..d6dfdeb 100755 --- a/conformance/tests/l0-static/auditability-proofs-producible/check.sh +++ b/conformance/tests/l0-static/auditability-proofs-producible/check.sh @@ -250,6 +250,11 @@ try: sys.dont_write_bytecode = True import record_run as rr # noqa: E402 + # status.py owns the latest-wins rule; import it rather than reimplementing it, so the two + # cannot disagree about which rows are live evidence. + import status as _st # noqa: E402 + rr_latest_by_test = _st.latest_by_test + smap = rr.sentinel_map(CONF / "tests") check(len(smap) >= 10, f"record_run.py's sentinel map contains {len(smap)} test(s) — the parser lost its " @@ -386,6 +391,15 @@ try: check(not bad, f"conformance/runs/ledger.jsonl has unparsable line(s) {bad} — the audit record " "is not machine-readable, so no proof can be derived from it") + # Which rows are HONOURED: status.py resolves duplicates latest-wins (latest_by_test), + # so a superseded row is not evidence of anything. The dirty-tree assertion below is + # therefore scoped to honoured rows. Without that scoping, ONE historical dirty row reds + # this gate permanently even after a clean re-run of the same test — and a dirty-then- + # clean sequence is the normal shape of "noticed the tree was dirty, fixed it, re-ran". + # The row is still kept in the ledger and its run.log stays committed: nothing is erased, + # it simply stops being treated as a live claim. Structural assertions (provenance keys, + # sentinel, test-still-exists) still apply to EVERY row. + honoured_ids = {id(v) for v in rr_latest_by_test(rows).values()} for r in rows: for key in ("ts_utc", "git_sha", "test", "requirements", "junit_result", "proof", "run_id"): @@ -408,7 +422,7 @@ try: check(r.get("test") in smap, f"a ledger row claims `proven` for {r.get('test')!r}, which is not a " "test in the suite any more — a proof of something that no longer exists") - check("-dirty" not in str(r.get("git_sha", "")), + check(id(r) not in honoured_ids or "-dirty" not in str(r.get("git_sha", "")), f"a ledger row claims `proven` for {r.get('test')!r} from a DIRTY tree " f"({r.get('git_sha')}) — what ran is not what is committed") else: