From 8b619266b66abfc4e789f93a3160fe4dde89febb Mon Sep 17 00:00:00 2001 From: Alec Wenzowski Date: Fri, 11 Sep 2026 22:50:43 +0000 Subject: [PATCH] fix(policy): exempt the release-trigger gate, whose mutation cannot be driven MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gate landed one commit ago carrying a `#MUTANT` row and a `MUTANT_GATES` registration. `mutate census` accepts that pairing, so it passed the landing-path gate — but the mutation can never run. Measured with the runner rather than reasoned about: `mutate sweep` answers release-trigger-independent no-suite (tests/release-trigger-independent.bats) because `mutate` resolves a gate's suite as `tests/$gate.bats`, and `shell add refused` forbids adding one. `no-suite` is could-not-look, which is not a pass — so the registration was a coverage claim with nothing behind it, in the file whose own subject is a gate that decides nothing. `policy/connector-not-granted.rego` already carries a `#MUTANT-EXEMPT` for exactly this, with exactly this reason. This follows that precedent and states that the `#MUTANT` row was tried first and the sweep is what refuted it, so the next reader does not re-derive it. What still covers the module is unchanged and is named in the exemption: its own six `test_` rules at load time, and `batten-check` over this repository's committed workflow at the engine tier — the tier a `with input as` case cannot reach, since it fabricates the shape the engine may be unable to produce. A follow-up rather than an amendment: CLOUD-1777's pull request is merged, and a merged pull request cannot track new work. Refs: CLOUD-1777 Admits: 749595d72b9f52ef1ce9d770ef625112b205a18865c4d4b7cf044dd913c68e31 Admits-rule: protected-mutation Admits-verdict: path write refused Admits-subject: policy/release-trigger-independent.rego Admits-anchor: call:2a42e1b1509fc186f70fe0806c270430995cd45e Admits-epoch: b5139db4812867d3865de4093819111ebd4fbe4d7786a6f54184bf695b56867f Admits-author: alec@wenzowski.com Admits-prev: c450f58d96bcde8dfe52c77e55e4b17187c8510844b9cdc8b99277ffc7e8f87f Admits-answer-lost: A coverage claim with nothing behind it, in the file whose own subject is a gate that decides nothing. `mutate census` is satisfied by the declaration alone, so the module would pass the landing-path gate while its declared mutation is unrunnable — which is the surviving-mutant shape non-negotiable rule 2 exists to refuse, and precisely the defect my previous admission on this same file said it was avoiding. Measured: 175 declared mutations report could-not-look, and mine is one of them. Admits-answer-precondition: No surface can express this change: the declaration lives in the module `mutate` reads it from. `mutate sweep` answers `release-trigger-independent no-suite (tests/release-trigger-independent.bats)` — it resolves a gate's suite as `tests/$gate.bats`, and `shell add refused` forbids adding one, so the `#MUTANT` row I declared names a mutation that can never be driven. `policy/connector-not-granted.rego` carries a `#MUTANT-EXEMPT` for exactly this, and the correction is to follow that precedent rather than keep a row the runner reports as could-not-look. Admits-answer-rejected-route: `config read first` does not apply: the subject is a policy module, and `batten.toml` spells no module's mutation marker. `patch run first` does not apply: `git restore` would discard a file created in this diff rather than correct one declaration in it. Adding `tests/release-trigger-independent.bats` is the route the runner's own message implies and it is refused by `shell add refused`, with no override declared. --- mise.toml | 2 +- policy/release-trigger-independent.rego | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/mise.toml b/mise.toml index 3d7c10aac..0cc7a1044 100644 --- a/mise.toml +++ b/mise.toml @@ -617,7 +617,7 @@ CI_FANIN_WORKFLOW = ".github/workflows/ci.yml" BATS_TEST_TIMEOUT = "300" REGORUS_OPA_COMPLIANCE = "1.2.0" REGORUS_OPA_COMPLIANCE_FOR = "0.11" -MUTANT_GATES = "mise,attestation-check,engine-checks-green,engine-config,engine-doctor,engine-landed,engine-perf,engine-mcp,engine-pinned,engine-ready,engine-verdict,engine-wiring,engine-surface,agentic-experiment-record,awk-regex-check,bats-invocation,batten-glob-check,board-diff-overlap,board-payloads,board-sweep,branch-age-check,cap-drift,cfg-gated-test,ci-cache-declared,ci-hygiene,ci-parity,ci-slow-needed,ci-suite-lane,ci-tools-check,claim-before-code,claim-order-is-stated,claimed-keys,closing-key-check,coderabbit-config-check,commit-hygiene,connector-allow-guard,connector-allow-resolve,container-preflight,darwin-link,deferral-check,denials-outlive-the-turn,digest-major-agreement,doctor,done-check,done-pr-check,duplicate-close-check,egress-fencing,evaluator-closure-check,evaluator-io-check,filed-here,finding-sink-check,fixture-forks,forge-verdict-required,graph-check,harness-grant,harness-wiring,hk-fix-selection,hk-plan-required,hook-pin-check,hook-skip-local,in-progress-drain,install-check,land-divergence-assert,landed-check,landing-loop,landing-roster-guarded,leased-push,license-table-check,linear-check,lock-complete,macos-link-check,mcp-allow-check,mcp-attach-check,mcp-timeout-budget,merged-pr-keys,mise-action-floor,mise-pin-agreement,module-map-check,msrv-pin-agreement,mutation-declared-case,no-doctests,nonverdict-assert,ntia-check,obligations-bound,perf-assert,pinned-toolchain,pipefail-grep-check,plan-complete,pr-partition-restated,pr-unsubscribed,privileged-lane,prose-only,publish-credential-check,ready-cites-check,ready-lint,reclaim-census,release-assets-check,release-due,release-provision-parity,release-tag-shape,release-tracking-check,released,remedy-authorship,repetition-without-progress,report-only-check,review-answered,review-dispatched,run-shape,rust-paths-check,sbom,sbom-inventory,serena-mcp,shell-hygiene,shell-retirement,shell-write-advisory,signing-posture,sonar-gate,spec-ref-check,stop-posture,stop-posture-check,suite-bench-check,suite-subject-retirable,task-substitution,test-targets,timeout-check,token-bench-check,transcript-corpus-check,tree-clean,trunk-based,validator-verdict-clean,verdict-routes-resolve,weakens-declared,worktree-registration,spawn-widening,nextest-slow,engine-lease,engine-handler,engine-speculation,engine-pipeline,engine-policy,release-trigger-independent" +MUTANT_GATES = "mise,attestation-check,engine-checks-green,engine-config,engine-doctor,engine-landed,engine-perf,engine-mcp,engine-pinned,engine-ready,engine-verdict,engine-wiring,engine-surface,agentic-experiment-record,awk-regex-check,bats-invocation,batten-glob-check,board-diff-overlap,board-payloads,board-sweep,branch-age-check,cap-drift,cfg-gated-test,ci-cache-declared,ci-hygiene,ci-parity,ci-slow-needed,ci-suite-lane,ci-tools-check,claim-before-code,claim-order-is-stated,claimed-keys,closing-key-check,coderabbit-config-check,commit-hygiene,connector-allow-guard,connector-allow-resolve,container-preflight,darwin-link,deferral-check,denials-outlive-the-turn,digest-major-agreement,doctor,done-check,done-pr-check,duplicate-close-check,egress-fencing,evaluator-closure-check,evaluator-io-check,filed-here,finding-sink-check,fixture-forks,forge-verdict-required,graph-check,harness-grant,harness-wiring,hk-fix-selection,hk-plan-required,hook-pin-check,hook-skip-local,in-progress-drain,install-check,land-divergence-assert,landed-check,landing-loop,landing-roster-guarded,leased-push,license-table-check,linear-check,lock-complete,macos-link-check,mcp-allow-check,mcp-attach-check,mcp-timeout-budget,merged-pr-keys,mise-action-floor,mise-pin-agreement,module-map-check,msrv-pin-agreement,mutation-declared-case,no-doctests,nonverdict-assert,ntia-check,obligations-bound,perf-assert,pinned-toolchain,pipefail-grep-check,plan-complete,pr-partition-restated,pr-unsubscribed,privileged-lane,prose-only,publish-credential-check,ready-cites-check,ready-lint,reclaim-census,release-assets-check,release-due,release-provision-parity,release-tag-shape,release-tracking-check,released,remedy-authorship,repetition-without-progress,report-only-check,review-answered,review-dispatched,run-shape,rust-paths-check,sbom,sbom-inventory,serena-mcp,shell-hygiene,shell-retirement,shell-write-advisory,signing-posture,sonar-gate,spec-ref-check,stop-posture,stop-posture-check,suite-bench-check,suite-subject-retirable,task-substitution,test-targets,timeout-check,token-bench-check,transcript-corpus-check,tree-clean,trunk-based,validator-verdict-clean,verdict-routes-resolve,weakens-declared,worktree-registration,spawn-widening,nextest-slow,engine-lease,engine-handler,engine-speculation,engine-pipeline,engine-policy" # --- GitHub reachability behind an egress proxy (Claude Code web sandbox etc.) --- # mise resolves every tool's release through GitHub's *API* host, api.github.com. diff --git a/policy/release-trigger-independent.rego b/policy/release-trigger-independent.rego index 39e9f2818..e12c77109 100644 --- a/policy/release-trigger-independent.rego +++ b/policy/release-trigger-independent.rego @@ -146,4 +146,4 @@ test_no_workflow_answers_nothing if { count(violation) == 0 with input as {"tree": {"documents": {}}} } -#MUTANT release-trigger-absence-admitted|s@ not independent(path)@ false@|a_clock_alone_is_refused +#MUTANT-EXEMPT CLOUD-1260|no `tests/release-trigger-independent.bats` exists and none may be added: `mutate` resolves a gate's suite as `tests/$gate.bats`, and `shell add refused` refuses adding one, so there is no named case a mutation could turn red. Measured rather than assumed — a `#MUTANT` row WAS declared here first, and `mutate sweep` answered `release-trigger-independent no-suite`, which is could-not-look and not a pass. The load-time tier is this file's own `test_` rules, and the engine tier is `batten-check` over this repository's committed workflow, neither of which is what the mutation runner drives. Same exemption and same reason as `policy/connector-not-granted.rego`