fix(ci): cure the AC4 currency gate's false positives, and wire it #990
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -73,7 +73,15 @@ | |
| 'dev-notes/*' # working notes, not compliance claims | ||
| '*HANDOVER*' # handover documents record prior state | ||
| '*CHANGELOG*' # a changelog that cannot name the old file is useless | ||
| 'launcher-standard_praxis.deed' # the canon itself, at a repo root; its ;; header records its own provenance | ||
| '*/launcher-standard_praxis.deed' # ...and the same canon VENDORED at any depth by a consumer (G2) | ||
| '*/descriptiles/META.a2ml' # descriptiles ADR carriers: dated architecture decision records | ||
| # (G3, AC1's exemption). Canonical spelling, 0-canon/CANONICAL-NAMES.adoc. | ||
| '*/6a2/META.a2ml' # ...and the deprecated '6a2' spelling of descriptiles. Both are needed: | ||
| # the estate migration is chartered separately and BOTH are on disk today | ||
| # (measured 2026-09-22: descriptiles 164 dirs, the deprecated one 770). | ||
| # NARROW BY DESIGN: matches only META.a2ml under those dirs, never | ||
| # `.machine_readable/launcher/*.launcher.a2ml`, which are live descriptors. | ||
| 'scripts/check-launcher-standard-currency.sh' # this file | ||
| 'scripts/tests/check-launcher-standard-currency-test.sh' | ||
| ) | ||
|
|
@@ -116,9 +124,11 @@ | |
| return 1 | ||
| } | ||
|
|
||
| # Scan $1 recursively for retired filenames and document-version claims that | ||
| # differ from $2. Allowlisted paths and DEED grammar/schema versions are ignored. | ||
| # Prints one typed record per defect; returns 0 when clean and 1 otherwise. | ||
| scan() { | ||
| local root="$1" expect="$2" defects=0 hit file lineno text rel found gap gaplc | ||
|
|
||
| while IFS= read -r hit; do | ||
| file="${hit%%:*}"; hit="${hit#*:}" | ||
|
|
@@ -132,9 +142,22 @@ | |
| defects=$((defects + 1)) | ||
| fi | ||
|
|
||
| if [[ "$text" =~ launcher-standard(\.a2ml|_praxis\.deed)([^0-9]{0,24})v?([0-9]+\.[0-9]+\.[0-9]+) ]]; then | ||
| gap="${BASH_REMATCH[2]}" | ||
| found="${BASH_REMATCH[3]}" | ||
| # G1 -- THE TWO VERSIONS ARE NOT INTERCHANGEABLE, AND THIS GATE TRACKS ONE. | ||
| # The header above says :schema-version is the GRAMMAR (1.0.0) and | ||
| # :standard-version is the DOCUMENT (0.4.0). This test used to accept any | ||
| # number within 24 non-digit characters of the filename, so a line reading | ||
| # `launcher-standard_praxis.deed` (DEED v1.0.0). Per-app config: | ||
| # captured the GRAMMAR version and reported it as document drift -- the gate | ||
| # asking a different question than its consumer, in its own implementation. | ||
| # The gap between filename and number says which version is being named, so | ||
| # read it rather than discarding it. | ||
| gaplc="${gap,,}" | ||
| if [[ "$gaplc" == *deed* || "$gaplc" == *schema* || "$gaplc" == *grammar* ]]; then | ||
| : # a grammar/schema version, not a document-version claim -- not a defect | ||
| elif [ "$found" != "$expect" ]; then | ||
|
Check failure on line 160 in scripts/check-launcher-standard-currency.sh
|
||
|
Comment on lines
+158
to
+160
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: sed -n '120,170p' scripts/check-launcher-standard-currency.sh
bash -c 's="launcher-standard_praxis.deed (DEED v1.0.0), standard v0.3.0"; re="launcher-standard_praxis[.]deed([^[:digit:]]|[[:digit:]]*[^vV[:digit:]])*[vV]([0-9]+([.][0-9]+)+)"; if [[ "$s" =~ $re ]]; then declare -p BASH_REMATCH; fi'Repository: hyperpolymath/standards Length of output: 2459 🏁 Script executed: set -eu
python3 - <<'PY'
from pathlib import Path
p = Path("scripts/check-launcher-standard-currency.sh")
lines = p.read_text().splitlines()
for start, end in ((145, 166), (1, 119), (167, 260)):
print(f"--- lines {start}-{end} ---")
for i in range(start, min(end, len(lines)) + 1):
print(f"{i}:{lines[i-1]}")
PY
bash -c '
text="launcher-standard_praxis.deed (DEED v1.0.0), standard v0.3.0"
re="launcher-standard(\.a2ml|_praxis\.deed)([^0-9]{0,24})v?([0-9]+\.[0-9]+\.[0-9]+)"
if [[ "$text" =~ $re ]]; then
declare -p BASH_REMATCH
gap="${BASH_REMATCH[2]}"
found="${BASH_REMATCH[3]}"
gaplc="${gap,,}"
if [[ "$gaplc" == *deed* || "$gaplc" == *schema* || "$gaplc" == *grammar* ]]; then
printf "suppressed gap=%q found=%q\n" "$gap" "$found"
else
printf "checked gap=%q found=%q\n" "$gap" "$found"
fi
fi
'Repository: hyperpolymath/standards Length of output: 13485 Continue scanning after a grammar-version match. For Process each subsequent version candidate on the line. Add the combined case to the self-test. Suggested fix- local root="$1" expect="$2" defects=0 hit file lineno text rel found gap gaplc
+ local root="$1" expect="$2" defects=0 hit file lineno text rel found gap gaplc
+ local version_tail candidate
...
- gap="${BASH_REMATCH[2]}"
- found="${BASH_REMATCH[3]}"
- # G1 -- THE TWO VERSIONS ARE NOT INTERCHANGEABLE, AND THIS GATE TRACKS ONE.
...
- gaplc="${gap,,}"
- if [[ "$gaplc" == *deed* || "$gaplc" == *schema* || "$gaplc" == *grammar* ]]; then
- : # a grammar/schema version, not a document-version claim -- not a defect
- elif [ "$found" != "$expect" ]; then
- printf 'DEFECT stale-version %s:%s claims v%s, current is v%s\n' \
- "$rel" "$lineno" "$found" "$expect"
- defects=$((defects + 1))
- fi
+ case "${BASH_REMATCH[1]}" in
+ _praxis.deed) version_tail="${text#*"$CANONICAL_FILE"}" ;;
+ .a2ml) version_tail="${text#*"$RETIRED_FILE"}" ;;
+ esac
+ while IFS= read -r candidate; do
+ [[ "$candidate" =~ ^([^0-9]{0,24})v?([0-9]+\.[0-9]+\.[0-9]+)$ ]] || continue
+ gap="${BASH_REMATCH[1]}"
+ found="${BASH_REMATCH[2]}"
+ gaplc="${gap,,}"
+ if [[ "$gaplc" == *deed* || "$gaplc" == *schema* || "$gaplc" == *grammar* ]]; then
+ continue
+ elif [ "$found" != "$expect" ]; then
+ printf 'DEFECT stale-version %s:%s claims v%s, current is v%s\n' \
+ "$rel" "$lineno" "$found" "$expect"
+ defects=$((defects + 1))
+ fi
+ done < <(printf '%s\n' "$version_tail" |
+ command grep -oE '[^0-9]{0,24}v?[0-9]+\.[0-9]+\.[0-9]+')🤖 Prompt for AI Agents |
||
| printf 'DEFECT stale-version %s:%s claims v%s, current is v%s\n' \ | ||
| "$rel" "$lineno" "$found" "$expect" | ||
| defects=$((defects + 1)) | ||
|
|
@@ -170,21 +193,59 @@ | |
| # allowlist control: the worst mutant, under a dated-audit path -- must NOT be reported | ||
| printf '# Compliant with %s v0.1.0\n' "$RETIRED_FILE" > "$tmp/docs/audits/old-2026-05-26.adoc" | ||
|
|
||
| # ---- G1/G2/G3 controls. Each of the three cures below silenced a MEASURED | ||
| # false positive on hyperpolymath/launch-scaffolder (4 of them). An exclusion | ||
| # without a mutant proving it is narrow is the vacuous-gate pattern, so the | ||
| # last fixture here MUST still fire: it is the one that proves the three | ||
| # exclusions did not also spare a true positive. | ||
| mkdir -p "$tmp/vendor" "$tmp/.machine_readable/descriptiles" \ | ||
| "$tmp/.machine_readable/6a2" "$tmp/.machine_readable/launcher" # canonical + deprecated spellings | ||
|
|
||
| # G1 control: the DEED GRAMMAR version, not the document version. Must NOT fire. | ||
| printf '| Standard: `%s` (DEED v1.0.0). Per-app config:\n' "$CANONICAL_FILE" > "$tmp/g1-grammar.adoc" | ||
|
|
||
| # G2 control: the canon VENDORED by a consumer, carrying its own provenance | ||
| # header naming the retired file. The allowlist used to name only this repo's | ||
| # own `launcher/` path, so a consumer got a false defect on the canon itself. | ||
| printf ';; translated from %s\n' "$RETIRED_FILE" > "$tmp/vendor/launcher-standard_praxis.deed" | ||
|
|
||
| # G3 control: dated ADR carriers. AC1 exempts a dated historical record, and | ||
| # META.a2ml under a descriptiles dir is an estate-wide convention. BOTH | ||
| # spellings are seeded because both are on disk: the canonical `descriptiles` | ||
| # and the deprecated one it replaces (0-canon/CANONICAL-NAMES.adoc). Neither | ||
| # must fire. | ||
| printf 'adr = "ADR-003" ;; superseded; named %s\n' "$RETIRED_FILE" \ | ||
| > "$tmp/.machine_readable/descriptiles/META.a2ml" | ||
| printf 'adr = "ADR-003" ;; superseded; named %s\n' "$RETIRED_FILE" \ | ||
| > "$tmp/.machine_readable/6a2/META.a2ml" # the deprecated spelling of descriptiles | ||
|
|
||
| # G3 NARROWNESS control -- THIS ONE MUST STILL FIRE. A live launcher descriptor | ||
| # lives under the same .machine_readable/ tree as the ADR carrier above, so a | ||
| # blanket '.machine_readable/*' exemption would have spared it. It is a real | ||
| # compliance claim against a deleted file and a dead version. | ||
| printf '# Compliant with %s v0.3.0\n' "$RETIRED_FILE" \ | ||
| > "$tmp/.machine_readable/launcher/demo-app.launcher.a2ml"; seeded=$((seeded+1)) | ||
|
|
||
| if [ "$seeded" -eq 0 ]; then | ||
| echo "SELF-TEST ERROR: zero fixtures seeded -- the self-test is vacuous." >&2 | ||
| return 2 | ||
| fi | ||
|
|
||
| out="$(scan "$tmp" "$CURRENT_VERSION")" || rc=1 | ||
|
|
||
| # Coverage counters. These are INCREMENTED BY THE CHECKS THEMSELVES so the | ||
| # summary line can never drift from the controls actually run -- the previous | ||
| # version printed a hardcoded "2 controls clean" while seven were present. | ||
| local fail=0 ndet=0 nabs=0 | ||
| check_detects() { | ||
| ndet=$((ndet + 1)) | ||
| if ! printf '%s' "$out" | command grep -q "$1"; then | ||
| echo "SELF-TEST FAIL: mutant survived -- expected to detect: $1" >&2 | ||
| fail=1 | ||
| fi | ||
| } | ||
| check_absent() { | ||
| nabs=$((nabs + 1)) | ||
| if printf '%s' "$out" | command grep -q "$1"; then | ||
| echo "SELF-TEST FAIL: false positive on: $1" >&2 | ||
| fail=1 | ||
|
|
@@ -197,6 +258,13 @@ | |
| check_absent 'm3.toml.*stale-version' # m3 is current; only the filename is wrong | ||
| check_absent 'clean.toml' | ||
| check_absent 'docs/audits' | ||
| check_absent 'g1-grammar.adoc' # G1: grammar version is not document drift | ||
| check_absent 'vendor/launcher-standard_praxis.deed' # G2: a vendored canon is still the canon | ||
| check_absent 'descriptiles/META.a2ml' # G3: a dated ADR carrier is a historical record | ||
| check_absent '6a2/META.a2ml' # ...same, in the deprecated spelling of descriptiles | ||
| # ...and the exclusions above must NOT have spared a live descriptor: | ||
| check_detects 'retired-filename .machine_readable/launcher/demo-app.launcher.a2ml' | ||
| check_detects 'stale-version .machine_readable/launcher/demo-app.launcher.a2ml' | ||
|
|
||
| if [ "$rc" -ne 1 ]; then | ||
| echo "SELF-TEST FAIL: scan returned 0 with mutants present." >&2 | ||
|
|
@@ -209,7 +277,11 @@ | |
| return 2 | ||
| fi | ||
|
|
||
| if [ "$ndet" -eq 0 ] || [ "$nabs" -eq 0 ]; then | ||
|
Check failure on line 280 in scripts/check-launcher-standard-currency.sh
|
||
| echo "SELF-TEST ERROR: a whole check tier is empty (detects=$ndet absent=$nabs)." >&2 | ||
| return 2 | ||
| fi | ||
| printf 'self-test: %s mutants seeded, %s detections asserted, %s false-positive controls clean, OK\n' "$seeded" "$ndet" "$nabs" | ||
| return 0 | ||
| } | ||
|
|
||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🛡️ Detected with Advanced Tier | 🟠 Major | ⚡ Quick win
Security Misconfiguration
Reachability: External
Exploitability: Trivial
CWE: CWE-693
Restrict the caller-local checker to the standards repository.
The event-SHA checkout supplies PR-controlled content. Any caller can add
scripts/check-launcher-standard-currency.sh, which this branch copies and later executes. A no-op script can therefore bypass the centrally managed governance gate.Use the local copy only when
GITHUB_REPOSITORYishyperpolymath/standards. Use the main-pinned copy for every consumer repository. Thecontents: readpermission limits token access, but it does not prevent this policy bypass.Proposed restriction
📝 Committable suggestion
🤖 Prompt for AI Agents