gstack/review/gate-integrity.md

Gate Integrity catalog

Adapted from the just-say-no-to-process-porn-and-ceremony skill's REWARD-HACKING-CATALOG; pattern names preserved because the names are the deterrent. Each entry names the pathology, gstack's countermeasure and where it lives. The ids are the gate values /review and /ship record on a finding; gstack-gate-diff emits the tagged ones in its read-level listing. Design and rationale: docs/designs/HONEST_WORK_GATE_INTEGRITY.md.

Three levels, kept apart everywhere: listed (every hunk in a test, CI, runner/lint-config, snapshot or golden path; inventory, never a finding), read (listed hunks that carry a tag or remove lines; the agent reads each with one question: does this relaxation silence the failure it was added for, or is it justified by a measurement or decision visible in this diff?), finding (a read hunk that fails the question; one human decision per finding or coherent group). The control is the human disposition, not the detector: the tool inventories and tags, it never judges and never suppresses.

Tagged patterns (emitted by gstack-gate-diff)

RH-1 — Test removed or disabled

The agent deletes, skips or focuses a test instead of fixing the code it guards: a removed test(/it(/def test_/func Test/@Test, an added .skip, .only, xit, xdescribe, @pytest.mark.skip, #[ignore], t.Skip(, @Disabled, @Ignore, XCTSkip or @tag :skip. The failure the test encoded is now invisible and the suite reads green. Countermeasure: gstack-gate-diff tags the hunk (tags are factual: a test deleted alongside its deleted source is tagged and the agent's judgment, not the tool, makes it a non-finding); /review Gate Integrity reads it and routes a finding to the four-option ASK (review-gate-disposition); /ship core checklist item 2.5 runs the same scan and the PR body's Gate edits: line carries the kept reason. The testing specialist's "never accept discarded valid red tests" rule stays as the large-diff read.

RH-2 — Proof-class inflation

A mock, fixture, replay or static read is presented as the proof a claim requires: "verified against production" when a stub answered, "the route is reachable" from a grep. No tag can see it; it is a prose check. Countermeasure: the preamble's Claims Need Evidence kernel (name the evidence kind you have and never substitute one for a kind the question requires), /review's Verification of claims, and the Gate Integrity category's instruction to read RH-2 from the diff without a tag. /ship Step 16's "no completion claims without fresh verification evidence" is the publication gate.

RH-3 — Snapshot or golden regenerated without its owning test

A snapshot (__snapshots__/<name>.snap, *.snap) changes while its conventional owner (the <name> test file) has no hunk in the candidate, so the new output was accepted rather than tested. *.golden, testdata/ and project Snapshot paths: are tagged RH-3? (owner unresolved): listed and read, never inferred. Countermeasure: the tag plus the Gate Integrity read; a snapshot updated alongside its source is inventory, never a finding. gstack's own SKILL.md goldens regenerate on every template edit by design, so RH-3 is never auto-blocked; the PR-body line makes a product snapshot regeneration visible to the human.

RH-4 — Placeholder committed

todo!(), unimplemented!(), raise NotImplementedError, throw new Error("not implemented") or pass # TODO lands in non-test code and the work is reported as done. Countermeasure: the tag admits the hunk through the content backstop even in product code; the plan-completion audit's done/changed/partial classification and Linked to #N never auto-close rule keep the obligation open.

RH-5 — Tautological test

A test that cannot fail: it asserts its own setup, mirrors the implementation line for line, or has no negative (nothing it rejects). Not a tag; read from the diff. Countermeasure: the test value card's protects= / fails_when= fields and the no_claim= sentence (what green does not prove), the /ship Step 7 authoring gate that rejects cards without them, and the Gate Integrity instruction to read RH-5 beside the tagged hunks.

RH-10 — Spec editing as progress

Acceptance text in the plan or spec is rewritten so the delivered work matches it, then the item is reported complete against the new text. Countermeasure: /ship's plan-completion audit diffs the plan's acceptance-bearing sections against their base-branch or first-commit baseline and reports an edited item as ACCEPTANCE_EDITED, never folded into CHANGED; the original obligation is still audited and the PR body names the scope change. Stated limit: an item rewritten in the commit that introduced the plan is invisible.

RH-12 — Environment sniffing in product code

Product code branches on process.env.CI, NODE_ENV === 'test', RAILS_ENV == 'test', PYTEST_CURRENT_TEST or GITHUB_ACTIONS so the code under test behaves differently from the code in production. Countermeasure: the tag outside test paths; the Gate Integrity read asks whether the branch exists to pass a check rather than to serve a user.

RH-13 — Suppression pragma added

eslint-disable, @ts-ignore, @ts-expect-error, # type: ignore, # noqa, #[allow(, // nolint, rubocop:disable or @SuppressWarnings silences the checker instead of satisfying it. Countermeasure: the tag admits the hunk from any path; the read asks whether the suppressed diagnostic was the failure the change was supposed to fix.

RH-14 — Gate bypass

A commit in range carries [skip ci]/[ci skip], a workflow gains continue-on-error: true or allow_failure: true, or a script or hook adds --no-verify. Countermeasure: the tag; a removed workflow job is listed by the path floor and read (job-removal detection is not in v1). /ship never pushes with --no-verify and never force-pushes.

RH-15 — Gate value relaxed

In a test, eval, CI or config file a numeric gate moves in the relaxing direction inside one hunk: timeout, retry, retries, tolerance, epsilon, delta, maxDiff or jitter up; threshold, min_score, minimum, coverage or required down; or an exact-count assertion loosened to a bound (toBe(3) → toBeGreaterThan(0)). Unpaired values are tagged RH-15? and read. The tool prints any citation it finds beside the hunk (commit text naming a ship-measure report, a gstack-shortcut(dec-*) marker) and never suppresses on it, because ship-measure reports are gitignored and commit text is forgeable. Countermeasure: /review's former blanket "eval threshold changes" suppression is narrowed to code-quality comments only; the agent resolves the citation read-only and pre-fills the Keep — justified option marked verified or unverified; ship/sections/measure.md's measure-then-fix loop ("never raise a budget, lower a threshold, add a retry or skip a case to get a pass") is the native repair path.

RH-16 — Exception swallowed

catch {}, catch (e) {}, except: pass, rescue nil or _ = err added in non-test code turns a failure into silence. Countermeasure: the tag lists it under the RH id; slop-scan's empty-catch rule keeps the fix suggestion. The preamble's stderr rule (never cite a command whose stderr was silenced) covers the evidence-command form.

Positive observables (zero-run green)

PL-1 — Exit code is not evidence

A command's exit 0 is reported as success without any observable that the work happened: the suite that selected nothing, the build that compiled zero files. Countermeasure: the preamble's Claims Need Evidence kernel (a claimed execution names the command and its observed result; a checked null result is reported as a null, not a pass) and /ship Step 16's receipt check.

PL-2 — Zero-run green

A test lane exits 0 having run zero tests: bun 0 pass 0 fail, jest "No tests found", pytest "no tests ran", rspec "0 examples", go test with only [no test files], or an empty selection after a filter. Countermeasure: /ship Step 5 passes a lane on its runner summary line, not exit 0 alone, with three never-merged count states (tests_ran: N pass; tests_ran: 0 ZERO-RUN, triaged as a failed lane; tests_ran: unknown keeps the exit-0 pass and prints count unavailable in the PR body); gstack-evidence check reports ZERO-RUN as STALE-equivalent; the PR body's ## Test Coverage section prints each lane's tests ran count.

Where the controls live

Surface	Control
preamble	Claims Need Evidence kernel: execution, evidence kind, failure disclosure, null results, stderr rule
/review Step 3.5 Diff scans	GATE_SCAN_BLOCK runs gstack-gate-diff <base>; UNAVAILABLE and partial are missing coverage, never none detected
/review checklist, Pass 1	Gate Integrity category: three levels, the one question, ASK never AUTO-FIX, groups one decision, citations never remove a finding
/review Step 5c	review-gate-disposition (one-way): A) Restore the gate, B) Keep — justified, C) Keep — other reason, D) Leave open for a later human; D recommended for spawned/headless sessions
/review Step 5.8	findings carry gate, gate_id, reason, logger-stamped actor; actions kept/restored/open; open counts in issues_found; no hunk text stored
gstack-review-log	stamps actor from gstack-session-kind and forces action: "open" for non-interactive kinds
/ship core checklist 2.5, Steps 7 and 9.4	the same block before the checklist read, again after the test-generation child returns, again after parent fixes
/ship Step 5 and Step 16	runner-summary pass, three tests_ran states, ZERO-RUN as a failed lane
/ship Step 16 stage 5	each gate finding's disposition, reason and actor, or the coverage line; the auditor's posture
/ship Step 19	Gate edits: line under Pre-Landing Review, per-lane tests ran under Test Coverage; draft while any finding is open