Skip to content

Refuse a borrowed quarantine where record 0019 puts none - #207

Merged
iderex merged 2 commits into
mainfrom
borrowed/one-quarantine-per-experiment
Aug 27, 2026
Merged

iderex merged 2 commits into
mainfrom
borrowed/one-quarantine-per-experiment

Conversation

@iderex

@iderex iderex commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Closes #206.

Record 0019 puts the quarantine at experiments/<slug>/borrowed and allows one
per experiment. Nothing refused a directory of that name anywhere else inside an
experiment. This adds that refusal, and corrects the two documents whose
sentences it falsifies.

The means

Go, in the package that already walks experiments/ and already refuses this
family, adding no language, no runtime and no dependency. The alternative
considered was a document saying the limit is the reader's to keep, which is what
the tree carried until this branch and is what 0019 calls a rule with no gate.
The proof apparatus this needs already exists here: the case harness derives its
property list from the source, so the fixture obligation arrived with the
constant rather than being remembered.

What is refused, and what is deliberately not

Refused: a directory named borrowed inside an experiment that is not
experiments/<slug>/borrowed.

Not refused: a directory of that name inside the quarantine. What is in
there is somebody else's code laid out somebody else's way, and
experiments/<slug>/borrowed/vendor/borrowed/ is that code's own business.
Refusing it would refuse honest work for the shape of a name this board does not
own, and the point of the quarantine is that this repository's rules stop at its
edge.

The walk takes the allowed path from the caller rather than deriving it a second
time, so the place it walks past and the place the licence arm judges cannot
drift apart.

The proofs

Three, each run at the head of this branch with the change reverted afterwards.

Deleting the skip at the quarantine reddens three cases, including the correct
experiment itself, because that same test is what excludes the allowed directory:

--- FAIL: TestCases (0.06s)
    --- FAIL: TestCases/a-borrowed-directory-inside-the-quarantine (0.00s)
    --- FAIL: TestCases/an-experiment-that-borrows-and-declares-it (0.00s)
    --- FAIL: TestCases/a-borrowed-directory-with-no-licence-file (0.00s)

That one proves the exclusion and the descent-stop together, so the second proof
separates them. Turning the skip into a descent that still allows the quarantine
(return fs.SkipDir to return nil) reddens only the case built for the
boundary:

--- FAIL: TestCases (0.07s)
    --- FAIL: TestCases/a-borrowed-directory-inside-the-quarantine (0.00s)

Removing the refusal site while leaving the walk running reddens only the case
that declares the property:

--- FAIL: TestCases (0.06s)
    --- FAIL: TestCases/a-quarantine-outside-the-place-quarantines-live (0.00s)

The refusing case declares exactly this property and no other and names
an-experiment-that-borrows-and-declares-it as its near neighbour, which differs
by that one directory and refuses nothing.

The bounds, written at the site rather than only here

Below WalkDepthBound nothing is examined. That is the bound the stray-record
walk already carries and already refuses a tree for reaching, so a tree deep
enough to hide a quarantine there is refused either way, and a second bound here
would give one tree two answers about how far a walk goes.

A symbolic link named borrowed is not a directory to fs.WalkDir, so it is
neither followed nor refused here. That is the position isDirectory already
takes at its own declaration, for the reason it gives there.

Nothing opens a licence file. A quarantine in the right place with the wrong
terms inside it is not this arm's subject and is not any other arm's either.

The documents

The second commit is a correction rather than an addition. #204 landed a
paragraph in CONTRIBUTING.md two hours ago saying a second quarantine passes
and that the one-directory limit was the reader's to keep rather than the gate's.
That was true when it was written and this branch makes it false, so it is
rewritten in the same change that falsifies it. The template gains the same two
sentences, because it already says what is refused and would otherwise be the
accurate half of a document that reads as complete.

The gate, at this commit

go build ./cmd/... ./internal/...
go vet ./cmd/... ./internal/...
gofmt -l cmd internal
go run ./cmd/lab check .
1 experiment directory walked, 1 record read
26 decision records read
0 refused

go test -count=1 ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	0.741s
ok  	github.com/Flowfin/lab/cmd/lab	3.195s
ok  	github.com/Flowfin/lab/cmd/notices	15.012s
ok  	github.com/Flowfin/lab/cmd/pullrequest	0.756s
ok  	github.com/Flowfin/lab/internal/check	1.023s
ok  	github.com/Flowfin/lab/internal/contexts	0.704s
ok  	github.com/Flowfin/lab/internal/hardware	0.704s
ok  	github.com/Flowfin/lab/internal/invariants	1.051s
ok  	github.com/Flowfin/lab/internal/notices	0.715s
ok  	github.com/Flowfin/lab/internal/prose	0.734s
ok  	github.com/Flowfin/lab/internal/pullrequest	0.703s

gofmt -l printed nothing, which is its passing result.

No second reader

Nothing here has been read by anybody but me. There is no second reader on this
board tonight, so the proofs above stand in place of one rather than beside one.
This is a new refusal on a walk that reaches every experiment, so the reader who
merges it should read refuseQuarantineElsewhere and decide for themselves that
the skip is in the right place.

What this does not do

It does not touch the clause #188 is waiting on. A borrowed/ directory in an
experiment whose record declares no Borrowed: still passes, record 0013
requires that, and whether it changes is a decision about that record rather than
anything here.

iderex added 2 commits August 27, 2026 04:05
Record 0019 puts the quarantine at experiments/<slug>/borrowed and allows one
per experiment, and nothing refused a directory of that name anywhere else
inside an experiment. A tree holding a correct quarantine and a second one
below it, carrying no licence file at all, passed with nothing refused.

What that costs is the reason the quarantine exists. The boundary is meant to
be readable off the layout by somebody promoting the work, so a second boundary
below the first means the first one was not the boundary, and the reader who
stopped at it learned something untrue. A declaration cannot cover it either:
the header names one source and one licence, so a second quarantine is
undeclared however carefully it was written.

The walk stops at the allowed quarantine rather than descending into it. A
directory named borrowed inside borrowed code is that code's own business, and
refusing it would refuse honest work for the shape of a name this board does
not own. It takes the allowed path from the caller rather than deriving it a
second time, so the place it walks past and the place the licence arm judges
cannot drift apart.

Two cases rather than one, because the skip is as much of the rule as the
refusal. One holds a second quarantine outside the first and declares exactly
this property and no other, with an existing passing case as its near
neighbour, differing by that one directory. The other holds a directory named
borrowed inside the quarantine and expects nothing.

Both were proved by breaking them. Deleting the skip reddens three cases,
including the correct experiment itself, because the allowed quarantine is
excluded by that same test. Turning the skip into a descent that still allows
the quarantine reddens only the case built for it.

The bounds are at the site. Below WalkDepthBound nothing is examined, which is
the bound the stray-record walk already carries and refuses a tree for reaching;
a second bound here would give one tree two answers about how far a walk goes. A
symbolic link named borrowed is not a directory to fs.WalkDir, so it is neither
followed nor refused, which is the position isDirectory already takes for the
same reason. And nothing opens a licence file, so a quarantine in the right
place with the wrong terms in it is no arm's subject.

Closes #206

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
The refusal in the commit before this one falsified a sentence in the
contributing guide, which said a second quarantine deeper inside an experiment
passes and that the one-directory limit was the reader's to keep rather than the
gate's. That was true when it was written and is not true now, and a guide that
says a rule is unenforced while it is enforced is worse than one that says
nothing: a reader plans around a gap that has closed.

The paragraph is rewritten rather than patched, because the split it was built
on has moved. It separated two refusals from two things that pass, and now three
are refused and one passes, so the sentence that carried the count carried it
into the wrong half.

What it adds beside the correction is the boundary, which the reader needs in
the same breath: a directory named borrowed inside the quarantine is not
refused, because the code in there is laid out by whoever wrote it. Without that
sentence the rule reads as a ban on the name anywhere under an experiment, and
somebody with a vendored tree would take it for a reason not to borrow at all.

The experiment template gains the same two sentences. It is where somebody
filling in a record reads what the field costs, and it already lists what is
refused, so leaving the third out would make it the accurate half of a document
that reads as complete.

Refs #206

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
@iderex
iderex merged commit db0a154 into main Aug 27, 2026
25 checks passed
@iderex
iderex deleted the borrowed/one-quarantine-per-experiment branch August 27, 2026 02:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Refuse a second borrowed quarantine inside one experiment

1 participant