From 85aaefb42da8fe8de2420e339a9311c408e0f0ae Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Fri, 4 Sep 2026 18:14:31 +0000 Subject: [PATCH] fix(freeze): mark the decision written after the helper prints, not before If gstack_hook_decision ever failed between the flag and its output the backstop would have stayed silent; setting the flag after the print keeps the deny backstop armed until a decision is actually on stdout. Co-Authored-By: Claude Fable 5.1 --- freeze/bin/check-freeze.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/freeze/bin/check-freeze.sh b/freeze/bin/check-freeze.sh index 43c5f3aea..02ac381ca 100755 --- a/freeze/bin/check-freeze.sh +++ b/freeze/bin/check-freeze.sh @@ -99,8 +99,8 @@ set -e # Unparseable payload (or no parser available): DENY. A boundary hook that # allows what it cannot read is not a boundary. if [ "$EXTRACT_RC" -ne 0 ] && [ -n "$INPUT" ]; then - _FREEZE_DECIDED=1 gstack_hook_decision deny "[freeze] Could not parse the tool payload to check the freeze boundary. Blocked (fail closed). Freeze boundary: $FREEZE_DIR" + _FREEZE_DECIDED=1 exit 0 fi @@ -163,7 +163,7 @@ case "$FILE_PATH" in # The reason is JSON-encoded by the shared helper. Never interpolate paths # into hand-built JSON: a path containing a quote or newline produced # malformed JSON here, and the deny silently no-oped. - _FREEZE_DECIDED=1 gstack_hook_decision deny "[freeze] Blocked: $FILE_PATH is outside the freeze boundary ($FREEZE_DIR). Only edits within the frozen directory are allowed." + _FREEZE_DECIDED=1 ;; esac