Repository navigation
[Low] Findings from the reviews of #214 and #215 #220
Description
Low-severity findings from the independent reviews of the #214 (shell targets after cd, code-running git config, local moves of main) and #215 (Low batch) fixes. None blocks a merge. Fix them together in one later PR.
command --beforecd(shell_targets._moves_directory).command -p cdis tracked, but a--aftercommandis not stripped, so a later relative write is read from the old directory.- Option values read as the fetch remote (
shell_targets._ref_move). Ingit fetch --depth 1 <path> main:mainthe value1is taken as the remote, so the local-path check does not fire. The move is fast-forward only. - Symlink
cd(shell_targets._shell_mutation_targets). Paths aftercdare joined as text, so acdthrough a symlink into a protected folder is not resolved. - One-shot code-running config (
git -c core.hooksPath=…,--config-env,GIT_CONFIG_*) is allowed. It runs only for that command, the same as running the program directly; recorded as an accepted limit. - Commits or merges while
mainis checked out move localmain; not covered by the ref-move guard. git checkout -B Mainon a case-sensitive FS is refused (case-folded) — accepted fail-safe.- Chained read names (
_policy_legacy.mcp_side_effect).list_pull_requests_and_issuesorget_run_and_logsnow count as writes and need a grant. Fail-safe; consider a noun list for the word afterand. .git/configof a linked worktree sits in the main repository's.git, reached by an absolute path, so the.git/configwrite guard does not cover it.
Not reproduced from #215: item 1 (Ruff does not apply an enclosing .gitignore to explicit paths; the 0-file case came from an enclosing ruff.toml and already reports skip) and item 4 (git from a scratch folder that is not a repository acts like git from the root, which is allowed anyway).
Additional Low finding from #233
- Entire clone suffix case (
.getzilla/getzilla/git_platforms.py, candidate271a8ae89f9a50aa9e725b7161c9ba0fd4bf0cd5). Native/etand mirror/ghclone URLs ending in uppercase or mixed-case.GITare not canonicalized like lowercase.git, so repository discovery fails closed withrepository_mismatch. Independent fixture probes reproduced both modes; lowercase.gitpasses. The pinned Entire CLI v0.12.2 parser callsgitremote.CutGitDirSuffixand explicitly treats the suffix without regard to case. Expected later batch fix: normalize this decoration case-insensitively while preserving the original clone URL, and cover native/mirror and empty-name refusal. No wrong-target write was observed. This P3 does not block Add Git platform registry and optional Entire adapter #233 under the repository Low-severity policy; fix it with the other Low findings in a later PR.
Дополнительное Low-наблюдение 03.11.2026 — отрицание deploy в задаче аудита
Связь с #138: preliminary routing остаётся отдельным источником friction.
На Getzilla 732b52cdb050145a0723d5c524fb730bdaac7542 выполнен scripts/getzilla_route.py --new-task с задачей:
Read-only audit of public upstream repositories and deduplicated GitHub backlog publication for Getzilla; include optional Jira addon design; no product code, release or deployment
Наблюдение: intent=release, risk=high, delivery_expected=true, delivery_lane=full; gates scope_and_design_approval и production_action_approval. Rationale: high-risk signal: deploy*.
Release/deployment явно исключены из requested scope. Ожидается, что такие исключения не становятся текущим operational intent. Сами GitHub issue mutations сохраняют отдельную точную авторизацию.
Это наблюдение о provisional prompt routing. Product tree остался clean; qualifying verifier не запускался по no-op contract. Ошибка exact-diff admission, обход разрешений или выполненный deploy этим не установлены. В будущий Low batch добавить EN/RU fixtures с отрицанием операций и issue-management prompts; существующие проверки настоящих release/deploy запросов сохранить.
Activity
Dimkox commentedon Oct 28, 2026
.grok/hooks/pre_tool_use.py::_grants_digest, Shell targets after cd, git config and main guards (#214); Low batch (#215); namespaced MCP reads and clear grant refusals #222). A grant that does not cover the denied call, or a pruned expired grant, also resets it. Each reset leaves a visible grant record. Consider resetting only when a grant that covers the denied action or resource is added.state.approval_mismatch, Shell targets after cd, git config and main guards (#214); Low batch (#215); namespaced MCP reads and clear grant refusals #222): their resource lists and a 12-character HEAD prefix. No secrets; the data is already in a local file.Generated by Claude Code
Dimkox commentedon Oct 29, 2026
Low follow-up from PR231 independent reviews at 7461364:
python3 scripts/getzilla_cleanup.py snapshot --remove <path> --jsonrejects the path as an unrecognized argument (exit2). Documentation recommends that order.snapshot <path> --remove --jsonsucceeds. Expected: documented argument order works. Fix docs/parser together in the next Low batch.gh api graphqlreview-thread query was classified as an external write; the connected list_pull_request_review_threads tool succeeded. This is workflow friction, not a bypass request. Preserve mutation controls while distinguishing read queries.Do not fold these tool fixes into PR231.
Dimkox commentedon Oct 29, 2026
Additional reproduced preexisting verification issues from PR231 at 7461364 (all involved source files are unchanged from main36bda337):
Runner scratch permissions:
.getzilla/getzilla/python_test_runner.py:314creates tmp with plain mkdir. Under the host's default umask it becomes0775. Pytest+coverage package tests then fail closed withPackageError: archive output ancestor grants untrusted rename authority(35 package failures in full local run). The same package test passes under unittest, and under the exact pytest+coverage command with owned scratch0700 and umask077. Expected: runner creates private scratch independent of ambient umask. Workaround: process-local umask077; retain archive security checks.Snapshot CLI argument parsing:
tests.test_review_snapshot.ReviewSnapshotTests.test_cli_creates_and_removes_a_snapshotfails on Python3.12.3 withsnapshot --remove <path>but passes on installed Python3.14.9. CI pins3.13 and passes. Expected: documented CLI form works on supported Python versions, or the supported runtime requirement is explicit. Workaround: intended newer interpreter with GETZILLA_NO_VENV=1 to prevent unintended .venv re-exec. This extends the prior cleanup-order finding.These are separate from the Entire change. GitHub linux/windows checks now pass on7461364. Local full verification will rerun with the corrected runtime/umask; failed runs remain failed.
Dimkox commentedon Oct 29, 2026
Additional source-observed test-fixture friction:
tests/_support.py:project_copycopies.getzillarecursively before deleting the copied runtime contents. A developer checkout with ignored worktrees, snapshots or a venv under runtime therefore traverses/copies those unrelated bytes first. Expected: omit runtime contents during copytree traversal while retaining any explicitly shipped marker files. Current PR qualification uses a clean worktree to avoid this cost; no fixture code was changed in PR231. This observation is from source inspection, not a measured fresh performance benchmark.Dimkox commentedon Oct 29, 2026
Additional baseline test friction observed on PR #231 head a3c18ca. Full local PR verifier using private Python 3.14 venv, umask 077 and 26 xdist workers returned 3 failed, 2565 passed, 19 skipped. Two failures reproduce with 3 workers: QualityContourTests.test_a_scan_that_reads_no_project_code_is_not_a_pass and test_lint_targets_include_the_project_python_outside_getzilla_paths. Expected their _PathTools fake Bandit; util.tool_search_path() prepends the interpreter venv/bin again and selects real Bandit. Both tests and util.py are unchanged from base 36bda33. Trigger: run those tests from a venv with Bandit installed. Fix the mock/tool lookup contract in a later grouped Low PR. A third FIFO receipt test failed in the full run but passes in the bounded repeat; its process.join(0.5) deadline is a suspected load sensitivity, not a proven diagnosis. No successful verifier receipt claimed. Also observed read-only jq piped to tail refused as ambiguous command root; using jq slicing alone succeeded.
Dimkox commentedon Oct 29, 2026
Verifier environment follow-up: both Bandit and Ruff mocks are affected by venv tool precedence. Keeping the real venv but moving only their launchers into a sibling scratch tools directory on PATH fixes the mock contract without source changes. Both real tools still run at pinned versions. All six failures seen across two full attempts were retested: 5 passed, 1 optional Trust parser dependency skip, 2 subtests passed. The intermediate base-Python/PYTHONPATH workaround was unsuitable: a nested runner deliberately replaces PYTHONPATH and loses pytest, and distro cryptography is incompatible with Python 3.14. These are environment observations, not product fixes or a PASS receipt. Full suite repeats with 12 workers to leave capacity for nested child workers and investigate the subsecond FIFO timing failures; no tests or coverage omitted.
Dimkox commentedon Oct 29, 2026
New baseline flake on unchanged worktree-safety code: candidate350fbd3 full local suite returned2581 passed,18 skipped,1 failure in WorktreeSafetyTests.test_a_hidden_process_of_ours_counts_only_when_newer_than_the_worktree. Exact-environment bounded repeat passed in0.90s. Test scans shared real /proc; _in_use conservatively counts same-UID processes with unreadable cwd. Assertions compare against pytest-worker start+60/+10 seconds, so long-running workers can see unrelated newer hidden processes. Child also expires after30s. Exact failed assertion is unavailable because verifier truncates test output after coverage tables; retain full raw test logs in a later fix. Isolate process inventory in this test. PID namespace probe is unavailable here (unshare uid_map operation not permitted). No test exclusion, status rewrite, or source-policy relaxation applied; repeat full gate remains required.
Dimkox commentedon Oct 29, 2026
Reproduced pre-existing Factory installer umask defect on unchanged factory code: full PostgreSQL exit suite ran1041 tests and failed only runtime-installer cases (1failure36errors). In factory/runtime/setup_manager.py _stage uses os.open with0444; inherited umask077 yields0400, then _release requires exact0444 and raises INVALID_RELEASE. Bounded module reproduces37failures under077; under022 it passes43tests+20subtests. Core tests/test_manifest_package.py under the same022 passes58tests+12subtests,1normal skip. Earlier Core ancestor problem came from host umask002 (0775 directories), not022 (0755). Use coherent global022 for next full run. Product should explicitly set intended file permissions rather than rely on caller umask; defer in this Low batch. No production policy change or extra test skip applied.
Dimkox commentedon Oct 29, 2026
Delivery friction observed and worked around: an exact merge grant created by getzilla_approve.py with cwd set to the isolated verification worktree was not found by the PreToolUse hook for gh pr merge with that same workdir. Hook resolves grants against the canonical root. Creating the same exact action/resource grant there allowed the protected exact-head merge. Protected report edits through apply_patch likewise resolve absolute nested worktree paths relative to canonical root, requiring canonical-root grants for those exact nested paths. Expected: consistent root resolution or an explicit diagnostic naming the grant root. No wildcard grant or bypass used. Final PR231 local full gate passed on350fbd3 (Core2582passed; Factory1041tests OK; coverage/restart probes pass), and PR merged after required exact-head checks and independent reviews. Prior environment findings remain for grouped follow-up.
Dimkox commentedon Oct 29, 2026
Low workflow finding during #236: after getzilla_route.py --reconcile added security_review to required_evidence, runtime package state.json retained only verification/code_review obligations. Final verifier passed, but getzilla_review.py refused both receipt writes with obligation_missing security_review. Corrected runtime accounting to the actual selected reports/results; both receipts then recorded and status showed zero gaps. Expected: reconcile also reconciles required receipt accounting, or package completeness flags this before a long final gate. Candidate93365620093d407737364e34dd54ac89db1f0241; source paths change.py/package_status.py and route reconciliation. No source fix included in #236.
Dimkox commentedon Oct 29, 2026
Low finding from independent review of #235 at 3488cd4: tests/test_model_continuation.py duplicate-key fixture resolves enabled to true without required candidates/bounds. It remains invalid after removing the duplicate-key guard, so that mutant survives. Production rejection works on an otherwise-valid duplicate object. Expected: the regression detects removal of the duplicate-key guard. Fix in the consolidated Low batch with an otherwise-valid duplicate-key fixture. Other four bounded mutants were killed; this does not block the current passive slice.
Dimkox commentedon Oct 29, 2026
Low workflow finding from #235 T3, observed 2026-10-29: apply_patch has the native session's canonical-root context even when an absolute target belongs to a routed nested worktree. A plan edit under
.getzilla/runtime/worktrees/issue235-t3/was classified as protected canonical runtime. A shell apply_patch heredoc with workdir set to that worktree was then rejected as ambiguous inline input. Expected: an explicit supported isolated-edit path with clear root/grant guidance. Successful bounded recovery after owner resume: issue the exact canonical-relative grant named by the hook, then use apply_patch; no protection was disabled. Structured protected-write remains available for control-plane files with the isolated workdir. Related root-resolution history: #80. No source write escaped the assigned worktree.Dimkox commentedon Oct 29, 2026
Recurring FIFO-test observation during PR #244 verification at exact 69f7b2f. The full Python 3.14 run with 12 xdist workers failed tests/test_workflow_artifacts_cli.py::WorkflowArtifactsCliTests::test_runtime_authority_fifo_fails_without_blocking and tests/test_workflow_artifacts_adversarial.py::CanonicalReceiptTests::test_receipt_symlink_and_fifo_fail_without_following_or_blocking. Result: 2 failed, 2658 passed, 18 skipped, 4743 subtests passed; coverage 82.22%. Factory checks were not executed after the failure. No passing gate was claimed.
Both tests start multiprocessing children, wait 0.5 seconds, terminate surviving children, then read a result queue. Both test files and workflow_artifacts.py are unchanged from base21a8465. Running the two named tests alone on the same exact clean worktree with the same Python 3.14 environment and two workers passed (2 passed in0.93s). The retained verifier stdout contains the failed test names but truncates the earlier tracebacks. Load-sensitive process startup is suspected, not proven. This matches earlier FIFO observations in this issue; no duplicate issue or candidate repair was made.
The coordinator is rerunning the full unchanged gate with eight workers. No tests or coverage are omitted. Follow-up should distinguish child startup from FIFO operation time and retain actual failure traces. The isolated PASS does not replace the failed full gate.
Dimkox commentedon Oct 29, 2026
Low finding from T4 security review at 3b8f1ca: the retained-pipe regression releases its child with a marker but deletes the temporary directory after 0.1 seconds without confirming child exit. A delayed child can miss the marker and remain until its 30-second fallback; failure before close may also leave the parent until that fallback. Fix the test cleanup with bounded exit acknowledgement in the Low batch.
15 remaining items
Dimkox commentedon Oct 31, 2026
Low diagnostic finding from the full local PR285 run on e810e49: the sanitized pytest failure summary retains
FAILEDnodes but omitsSUBFAILEDsummaries. A bounded reproduction exposed three subtest failures in test_remote_push_flags_not_available in addition to the eight retained failed methods. All shared the same fixture-placement cause; the unchanged complete module passed (18 tests, 3 subtests) when the temporary root was outside a Git ancestor. The gate correctly remained FAIL, so this is loss of diagnostic detail, not false success. Later Low-batch acceptance: preserve safe subtest failure identifiers/counts without leaking captured values or weakening failure/coverage semantics.Dimkox commentedon Oct 31, 2026
Three bounded Low findings for the next validation/tooling batch:
The two input-validation repairs are committed locally as 325b74d151907fad513e18f2cf7f2a2f712cfe00 (five files, production diff +5/-4). Focused controls passed 67 tests and 95 subtests; Ruff, existing secret/contract checks and named no-record smoke passed. Independent code/data/security review and complete final qualification remain pending. Neither parent feature issue nor this aggregate issue is complete.
Dimkox commentedon Oct 31, 2026
Additional bounded compatibility regression observed in PR284 at02abd29f: Linux CI job124604811208/run41224198385 failed two existing controls for a harmless HTTP read with a literal no-proxy wildcard option. The new HTTP role collector refused it as unresolved. The original negative controls for real header/data file operands remain required. All static checks and Trust CI tests passed; Core ran3,012tests with two failures and35skips.
Affected tests: test_optin_scratch_hardening.CurveHeaderFileTests.test_header_file_operands_are_secret_reads and test_owner_optins.CurlValueTests.test_noproxy_star_is_not_a_secret_glob_but_data_files_still_are. The current isolated Core repair owner will fix the option-role classification and run these unchanged controls with adjacent negative cases. No passing claim or test-expectation relaxation. CI evidence: https://github.com/Dimkox/Getzilla/actions/runs/41224198385/job/124604811208
Dimkox commentedon Oct 31, 2026
The scanner characterization also exposed a distinct protected report-output admission gap. It is assessed High and is now tracked separately as #288 / GZDEV-54. It must not inherit this aggregate's Low/nonblocking disposition. No scanner or protected write was executed. The separate validation/preflight batch will repair the accepted bounded input/output argument contract and obtain its complete selected reviews and delivery gates. The original read false-positive remains linked here.
Dimkox commentedon Oct 31, 2026
Low — deterministic queue-provenance false positive found by the complete local gate for PR #284, exact head
29abc50e15401c06f2eda7b941f2d4b876f8ee3c(2026-10-31 20:09 UTC).Observed:
FIT-BOUNDED-WORKER-JOBSreportsqueue_provenance_unresolvedfor.getzilla/getzilla/architecture_diff.py. The fixed-three-entryregistrations.extend(GeneratorExp)is not modeled byqueue_provenance._evaluate;_mutate_callreplaces the known ordinary list with UNKNOWN_QUEUE when it cannot derive extension length. The following ordinary append produces the sole new semantic queue signal.Expected: finite ordinary registration data should not become a queue receiver; genuine queue-bearing iterable values and unknown cases must retain conservative provenance. Two independent analyses plus actual base/head and minimal controls confirm the false positive. A real queue-bearing generator control still detects queue use. No queue protocol changed and no analysis budget was exhausted. Closed #25 is related history, but its loop/value-budget mechanism differs.
Core will use an explicit finite sequence for these three fixed registration entries, retaining every strict Git identity field and label. That is a bounded workaround, not a classifier repair. Keep this Low item open for a separate sound, bounded comprehension-provenance repair with ordinary-data and real-queue/alias/filter/unknown controls. Do not raise budgets, suppress the rule or mark the failed gate passed.
The full gate remains FAIL: 2,997 tests / 6,422 subtests passed, 36 skipped, coverage 81%; architecture is the primary failure and governance fails downstream. No receipt, merge or issue closure follows this result.
Dimkox commentedon Oct 31, 2026
Verification-environment follow-up from PR #284 at
021d0bc145e8f0dee70ff926d347fdd52faf91e8: the first full local gate failed in eight tests intests/test_adopt_existing_cli.pybecause their temporary fixture root had a Git-marked ancestor. The CLI correctly returned GIT_PRESENT; this denial must remain intact. The verifier reached this after a 359.782-second Core run with automatically selected six workers (observed capacity 8, reserve 2, cap 6).A fresh owned 0700 temporary root outside all Git ancestors resolved the condition without any source or guard change. The complete adoption CLI module plus both scanner-fixture controls passed: 20 tests, 27.525-second no-record verifier observation, stable HEAD/fingerprint. The whole qualifying gate is being rerun; the initial full FAIL and its unqualified coverage remain retained (report SHA256
48f03d57891e70edc741d0696d57273bfa56853e109a841b74c436749fa7c846).Bounded follow-up for this existing low-severity workflow collection: detect unsuitable fixture roots before a costly full run and provide an actionable owned non-repository fixture location. Do not remove ancestor markers, weaken Zero-Git admission, or convert a failed test run into accepted coverage. This observation does not expand PR284 or close GH220.
Dimkox commentedon Oct 31, 2026
Partial scope delivered in merged PR #284, main commit
f6afa96afa91ac44e7e93f558687d792ae1eae32(reviewed head021d0bc145e8f0dee70ff926d347fdd52faf91e8).PR284 delivers diagnostics, bounded controls and the explicit finite registration sequence that avoids the observed queue-provenance false positive. The underlying general queue classifier gap remains open. The later unsuitable temporary-fixture-root diagnostic follow-up is recorded in comment6549283655; the correct Zero-Git refusal was preserved.
The exact delivered candidate has fresh independent code/security PASS, full local verifier PASS (3,004 tests and6,462subtests,81.167234%coverage), and required Linux/Windows CI PASS. Full report SHA256
7a83eaae18943e059356b30138278abcf1fcc86aafe165745c6014a7395d9312.This issue and linked GZDEV-29 remain open. Delivery of this subset is not closure of the wider acceptance criteria.
Dimkox commentedon Oct 31, 2026
Low follow-up from the GH250 investigation (source inspection at b1f5833): read-ledger expiry cleanup can race with a refresh.
.getzilla/getzilla/read_ledger.py::_prunechecks a ledger mtime and later unlinks the pathname;recordinvokes that cleanup after releasing the reads lock. A writer can replace an old ledger with fresh content between those operations, allowing cleanup to delete the refreshed file.Expected: pruning must not remove a ledger refreshed by a concurrent participating writer. This is source-observed and has NOT been reproduced by an executable probe; there is no production-loss claim. It is separate from the two reproduced runtime-lock ownership races in #250 and cannot explain the fresh single-session 40-writer fixture. Add a bounded expiry/refresh regression and the matching cleanup serialization in the later Low batch. The current GH250 repair does not claim to fix it.
Dedup: repository issue search for read_ledger/prune returned no match; all 35 existing comments in this collector were checked.
Dimkox commentedon Nov 1, 2026
Low — completed-delivery status can report a stale review plan after the merged main ref is fetched.
Observed after PR #290: reviewed head f5ff039 and tree8cc8e9691d0eff179deb801445858ae8e9f5bc79 stayed clean and unchanged. Pre-merge ready-status had no evidence gaps. After normal merge to84f3279558b74c068f0715b102b3b9c80c363d53, fetch and route completion, status reported only 'review plan is missing, stale or contradictory'.
Read-only source diagnosis reproduced the cause: the PR-target comparison now includes merge-base f5ff039 in addition to the recorded route base b1f5833. That changes the rules/assessment/review-plan digests even though source, risk category and selected reviewers are unchanged. The completed flag alone is not the cause. Raw before/after status and derived-plan data are retained in adjacent-completed-plan.json.
Expected: retrospective completed-delivery status should preserve and explain the qualified comparison evidence, while a genuinely new source/base/scope still requires fresh assessment. Add a bounded regression and distinguish archived qualification from current working-target assessment. Do not weaken pre-merge review requirements or rewrite historical receipts. This does not invalidate the zero-gap pre-merge result or reopen the delivered GH250 repair. It remains a separate Low item outside the active continuity PR.
Dimkox commentedon Nov 1, 2026
Bounded pre-existing schema equality finding from the GH155/GH165 design audit at main0d803e5f29d8447a4de85f6193a60216771b6192.
Actual helper control: Core getzilla.spec.validate_schema accepts integer0 against an untyped constant-false schema, while the reference Draft202012 validator rejects it. Adding an explicit boolean type makes Core reject0 as expected. Python value equality is insufficient for JSON scalar type identity. The complete media design schema is also outside the Core subset (number) and the test subset (description); those unsupported-dialect refusals are expected, not defects.
Expected follow-up: test JSON-consistent constant/enum equality and nested scalar distinctions without weakening existing type checks or unsupported-keyword rejection. Current observed impact is a schema-conformance discrepancy; no protected action, privilege bypass or deployed exploit is established. A separate scope/impact review should assess enrolled schemas before assigning broader consequences.
The media design work will use an explicitly supported schema with typed constants and exact rational/integer measures; it will not modify the Core validator to conceal the issue. Source/hashes and fresh comparison output are retained in media-repo-analysis-20261101/source-and-schema-observations.json. No matching constant-type finding was present in this collector's body or37comments.
Dimkox commentedon Nov 1, 2026
M1 integration audit found a separate Low distribution gap on exact main
0d803e5f29d8447a4de85f6193a60216771b6192:scripts/getzilla_report.pyis absent frominstall_into.MANAGED_FILES, whilescripts/is not a managed directory. The engine modules are shipped, andgetzilla_cli.script_path()can fall back to the global report script when the project script is absent. This establishes an inventory omission and a potential script/engine version mismatch; an installed-consumer failure has not yet been executed.Deduplication checked open and closed issues for the exact script, report+installer and MANAGED_FILES. Closed #145 concerns report coverage output/documentation; it does not cover distribution. No matching item was found in the retained #220 grouping.
Planned in the current #152/#200 reader slice: first reproduce the missing installed script, add its exact managed entry, and verify fresh lean ZIP, files-layout upgrade and nested global CLI dispatch use the project script with its own engine. Preserve legacy report output and journal bytes. This comment records a static finding, not a passing implementation or whole-issue closure.
Evidence: independent integration report SHA-256
962560d6b6cedba5c999b0cf89569194680e44f280efc804aac180b4c8f5668d; source/hash inventory and analysis retained in the continuation checkpoint.Dimkox commentedon Nov 2, 2026
Low: cost guard classifies an endpoint assertion as a paid call
Observed on PR #298 at exact HEAD
a1eb5fa01fb27f1e88fbf9d8aedcfaf47a3b7886(2026-11-02). The first full native PR gate refused withCOST_CONTRACT_MISSINGbefore Core/scanner/factory execution. Its only finding wasPAID_CALL tests/test_model_data_admission.py:59 self.assertEqual; the assertion compares endpoint metadata and performs no provider operation.cost_guard._PythonCost.visit_Callcurrently treats a provider hostname in any call argument as paid use, without distinguishing the callee. This also leaves the misleading summary “1 paid call sites” after a contract is present. Expected: a proven non-effectful assertion/metadata comparison should not be classified as a paid transport call, while real provider calls, unbounded operations and ambiguous cases remain guarded. Do not exempt all tests or all hostname arguments.For the current offline-only delivery, the separate runtime contract records actual enforced zero live calls and zero spend. The positive v1 schema minima (one call/one cent) are conservative ceilings only, not live permission;
dispatchis the real tested function that unconditionally refuses before claims/network. The independent security follow-up checked that reasoning. The scope decision was rebound through the native API after the added contract invalidated the old scope hash. No detector/test source was weakened and no paid-run approval or provider activation was created. The fresh full qualifying run remains required; this is not a PASS claim for the failed attempt.Follow-up in the Low batch: add callee-aware non-effectful metadata handling with positive real-call controls, and make the summary reflect actual classification. Broader issue #235 remains open.
Recurrence on selection repair — 2026-11-02, 18:16 MSK
Exact source
2a79110fcd7477e2aacbc8806792e278f9d1abe0, full review base997a048d291893d7e78ae8efddd78f06a19414cc. The first full PR attempt ended FAIL at 15:01:37 UTC with two findings:tests/test_agent_setup.py:68 self.assertEqualand:240 self.assertIn. Both compare literal OpenRouter URLs. The scanner examines entire changed-file blobs; these assertions predate this change. Heavy checks that did not execute after the refusal are not passes. The failed report and verification receipt are retained.An independent audit inspected the closed local configuration branches and ran one bounded Linux probe with socket and child-process APIs denied. The guard self-check was effective; Qwen, Claude, Codex and missing-key Qwen completed with zero forbidden attempts, provider calls or spend. No real key or user profile was read.
configureis a structural local-only boundary, not an installed numeric quota or a general network-denial mechanism. Later running a configured agent is outside this accounting.The runtime-only contract explicitly records those limits and zero actual usage. Its one-call/one-cent values are positive schema minima used only as ceilings, never permission. The exact independently reviewed draft was installed; native scope bookkeeping was rebound to the changed scope digest. Reviewed source and context digest remain unchanged. Both false-positive findings remain visible, no scanner/test source was altered, and no paid-run approval was created. A fresh full PR retry is now running; no completed full-gate or hosted-CI result is claimed here.
Independent accounting report SHA256:
fa5f05ce6aca729335dd8430432873afa29abae7c0be11d610760876ca294db6. This strengthens the existing callee-aware detector follow-up above; it does not resolve that defect or broader #234.Dimkox commentedon Nov 2, 2026
Low: stale local package manifest is reported only after the expensive Core run
Observed while qualifying PR #301 at unchanged source
12c1f8849ffb72d0a378580a10c0e4f295dd0780. The first complete native run ended FAIL at 2026-11-02T16:05:21Z. Core used six workers for 655.735 seconds and reportedDoctorTests.test_project_doctor_has_no_failures; focused reproduction identified exactlychecksum mismatch: tests/test_getzilla_identity.py.The coordinator had left an ignored, untracked
MANIFEST.sha256generated before the three-line identity-inventory repair. Its old digest matches the exact parent2a79110f.... Independent read-only rendering compared all 6,048 entries and found exactly one checksum change, with no additions, removals or other differences. This was a local generated-artifact setup error; it does not establish a defect in the committed product bytes.The old manifest, failed report/receipt and RED reproduction were preserved. The standard
scripts/generate_manifest.pythen produced the independently predicted SHA256f22c7cab5e5c453e7ea78353b5cc6a4c8a8b2c3585440e4483d0f56ac6090eb8.scripts/verify_manifest.pyand the exact doctor case passed. Source HEAD/tree/fingerprint/context did not change. A new complete native run is required and is running; the earlier FAIL and non-qualifying coverage are not relabelled.Follow-up for the existing Low batch: detect and name an existing stale generated manifest in the bounded preflight before the expensive Core suite. Do not silently regenerate it, remove its check, or assume every difference is harmless. Preserve comparison against the recorded source and require inspection of the complete artifact diff before an explicit refresh.
Independent diagnosis SHA256:
9e0b175fde096b290e70dbf56c8f951ed3f9b71357b878ba4c05a5e2608704a5. Searches of open/closed issues for manifest/doctor and stale MANIFEST.sha256 found no specific duplicate; the broad historical issue #72 is not this finding. This item is separate from the cost-scanner false positives and from deployment snapshot/recovery readiness in #300.Final observation: the subsequent complete native run on unchanged
12c1f8849ffb72d0a378580a10c0e4f295dd0780passed at 2026-11-02T18:36:42Z: 3,295 tests and 7,195 subtests passed, 36 skipped; coverage 81.607754%. Factory unit and QG-01 passed; PostgreSQL exit remained explicitly skipped for repository-sandbox capability. Current review receipts validated with no gaps. The earlier failed attempt remains FAIL. This closes the local artifact mismatch for PR301, not the proposed early-detection improvement or the whole Low batch.Dimkox commentedon Nov 2, 2026
Low finding from PR #302 — schema/runtime trailing-newline mismatch
Independent data review on exact HEAD
f5c732eea389808aad13e6688f6ea7201d033299reproduced a nonblocking discrepancy inschemas/deploy-preflight-manifest-v1.schema.json: patterns ending in$accept a final LF in the testedproject_id,credential_selectorandoperator.pathfields under Draft 2020-12 validation. The runtime rejects the same inputs withINPUT_INVALID,INPUT_INVALIDandPATH_UNSAFE, respectively.This is an authoring/validation consistency defect; the runtime admission boundary remains closed. Retain it in this Low batch under the repository policy; no frozen-candidate change or issue #300 closure is implied.
Expected later fix: use end-of-input-safe schema patterns compatible with the supported JSON Schema regex semantics, review every related identifier/path pattern, and add paired schema/parser controls for LF/CR/control suffixes and valid strings. Do not relax the runtime parser to match the schema.
Fresh review evidence: 33 repository tests and 7 independent data controls passed; all 12 scoped mutants were killed by intended assertions. The complete report separately records UNKNOWN native snapshot cleanup; data-test success does not establish cleanup success or DEV readiness.
Dimkox commentedon Nov 2, 2026
Low workflow friction observed while qualifying PR #302
The package for route
5bcc536239aewas created from the provisional plan withverificationandcode_reviewaccounting rows. Committed-source reconciliation correctly addedsecurity_review,data_reviewandrelease_reviewas mandatory evidence, but the package'sevidence_accounting.obligationsremained at the initial two rows.A fresh
getzilla_status.pybefore the final gate reported threeobligation_missingpackage errors, even though all four complete independent reports had been preserved. These are accounting errors, separate from the expected absence of not-yet-recorded verification/review receipts. The inspected change CLI exposes start/transition/show, with no accounting reconciliation command.For this task the coordinator added exactly the three required not_run obligations under the existing serialized-task/real-owner/atomic JSON helpers, preserving other state and independently comparing context before/after. No PASS, receipt, approval or narrowed obligation was created. The actual full native PR gate then started on the unchanged source/context.
Suggested Low follow-up: reconcile new mandatory obligation rows idempotently when review policy expands, or expose/document an owner-bound accounting command; preserve existing outcomes and scope bindings. Add an executable regression for package creation followed by exact-source reviewer expansion. This workflow improvement is not implemented in PR302.