From a8c295d49d85bb2760f78c98ea7ea2fcbbc2e587 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 7 Jun 2026 18:18:02 -0700 Subject: [PATCH] fix: address pre-landing review (codex) on the carve MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - cso section: add a scope-gate header so '--owasp' (and other scoped modes) run only their selected phases, not every phase bundled in the section ('execute in full' no longer overrides Mode Resolution). - carve-guard-checks: gateAfterStop now compares against the LAST STOP, not the first, so a gate stranded between two STOPs in a multi-STOP skeleton fails. - TODOS: behavioral section-loading hermeticity (verifier matches global-install path, not the fixture) — pre-existing in auq-sdk-capture.ts, deferred. Co-Authored-By: Claude Opus 4.8 (1M context) --- TODOS.md | 22 ++++++++++++++++++++++ cso/sections/audit-phases.md | 2 ++ cso/sections/audit-phases.md.tmpl | 2 ++ test/helpers/carve-guard-checks.ts | 8 +++++--- 4 files changed, 31 insertions(+), 3 deletions(-) diff --git a/TODOS.md b/TODOS.md index 0f84e07b9..de8d1c133 100644 --- a/TODOS.md +++ b/TODOS.md @@ -2312,3 +2312,25 @@ from there. **Effort:** M (human ~2d, CC ~4h). **Depends on:** `transcript-section-logger.ts` real-session-drift rework. + +### P2: Harden behavioral section-loading test hermeticity + +**What:** `captureSectionReads` in `test/helpers/auq-sdk-capture.ts` accepts ANY +Read whose path matches `sections/.md`. The skeleton's STOP-Read directive +points at the gstack-root install path (`scripts/resolvers/sections.ts` builds it +from `ctx.paths.skillRoot`), not the planted fixture copy. So a run can satisfy +the section-read assertion by reading the GLOBAL install's section instead of the +hermetic fixture. + +**Why:** A behavioral test that passes by reading the global install doesn't prove +THIS branch's carved section loads. If the fixture's section were broken but the +global install's weren't, the test would still pass. + +**Context:** Codex outside-voice finding on the carve-guard ship (v1.57.0.0). +Pre-existing in `auq-sdk-capture.ts` — affects `skill-e2e-ship-section-loading`, +`skill-e2e-plan-ceo-review-section-loading`, and the new +`carve-section-loading.test.ts`. Fix: match the fixture's ABSOLUTE sections path +(the `planDir` copy), not a bare `sections/.md` regex; or rewrite the STOP +path to the fixture during the run. + +**Effort:** S (human ~3h, CC ~30min). **Depends on:** None. diff --git a/cso/sections/audit-phases.md b/cso/sections/audit-phases.md index b395311a2..419cc5332 100644 --- a/cso/sections/audit-phases.md +++ b/cso/sections/audit-phases.md @@ -1,5 +1,7 @@ +**Scope gate (read first).** This section holds every scope-dependent phase (2-11), but you run ONLY the phases your resolved mode selected back in `## Mode Resolution` (always-loaded in the skeleton). Phases 0, 1, 12, 13, 14 always run; Phases 2-11 are scope-gated. "Execute in full" means work through this section applying that selection, NOT run a phase your mode did not select just because its prose lives here. Example: `--owasp` runs Phase 9 from this section, not Phases 2-8/10/11. + ### Phase 2: Secrets Archaeology Scan git history for leaked credentials, check tracked `.env` files, find CI configs with inline secrets. diff --git a/cso/sections/audit-phases.md.tmpl b/cso/sections/audit-phases.md.tmpl index 7e4709280..e2e9db0a7 100644 --- a/cso/sections/audit-phases.md.tmpl +++ b/cso/sections/audit-phases.md.tmpl @@ -1,3 +1,5 @@ +**Scope gate (read first).** This section holds every scope-dependent phase (2-11), but you run ONLY the phases your resolved mode selected back in `## Mode Resolution` (always-loaded in the skeleton). Phases 0, 1, 12, 13, 14 always run; Phases 2-11 are scope-gated. "Execute in full" means work through this section applying that selection, NOT run a phase your mode did not select just because its prose lives here. Example: `--owasp` runs Phase 9 from this section, not Phases 2-8/10/11. + ### Phase 2: Secrets Archaeology Scan git history for leaked credentials, check tracked `.env` files, find CI configs with inline secrets. diff --git a/test/helpers/carve-guard-checks.ts b/test/helpers/carve-guard-checks.ts index eaf7d0e59..57cccc9da 100644 --- a/test/helpers/carve-guard-checks.ts +++ b/test/helpers/carve-guard-checks.ts @@ -114,12 +114,14 @@ export function checkOrdering(root: string, guard: CarveGuard): string[] { // 5. The post-STOP gate fires after the last STOP (review skills). const gate = guard.staticInvariants.gateAfterStop; if (gate) { - const firstStop = skeleton.indexOf(STOP); + // Gate must fire after the LAST STOP (once all section work returns), not just + // the first — for multi-STOP skeletons a gate between two STOPs is stranded. + const lastStop = skeleton.lastIndexOf(STOP); const lastGate = skeleton.lastIndexOf(gate); if (lastGate < 0) { failures.push(`gateAfterStop marker missing from skeleton: "${gate}"`); - } else if (firstStop >= 0 && lastGate < firstStop) { - failures.push(`gateAfterStop "${gate}" appears before the STOP (stranded above it)`); + } else if (lastStop >= 0 && lastGate < lastStop) { + failures.push(`gateAfterStop "${gate}" appears before the last STOP (stranded above it)`); } }