Skip to content

Pin the microsim guard's blind spots; reject prefixed identifiers - #79

Merged
MaxGhenis merged 1 commit into
mainfrom
microsim-guard-residuals
Aug 2, 2026
Merged

Pin the microsim guard's blind spots; reject prefixed identifiers#79
MaxGhenis merged 1 commit into
mainfrom
microsim-guard-residuals

Conversation

@MaxGhenis

Copy link
Copy Markdown
Contributor

Follow-up to #77, closing the three residual nits from the round-3 adversarial review (sol, gpt-5.6-sol) that accompanied its MERGE verdict:

  1. Prefixed-identifier false positive: the module-qualified constructor pattern lacked a leading boundary, so notpolicyengine_us.Microsimulation would have tripped it. Now (?<!\w)policyengine_(us|uk)\b…, with an allowed-corpus entry pinning the fix.
  2. Blind spots documented as behavior, not prose: MICROSIM_KNOWN_MISSES pins the guard's five documented evasions (backslash continuation before import, hybrid backslash-then-paren import, aliased constructor, import *, dot-split qualified constructor) with a test asserting they are not caught — so the limits are explicit, and any future tightening must consciously move an entry into MICROSIM_BANNED_SAMPLES. The module docstring now states exactly what is caught vs missed.
  3. Doc drift: the plugin-maintenance skill's scan-suffix list now includes .ipynb, matching SCAN_SUFFIXES.

Corpus: 12 banned + 11 allowed + 5 known-misses. uv run pytest --ignore=tests/test_skill_examples.py: 97 passed. Wrapper smoke build: OK.

🤖 Generated with Claude Code

Follow-up to #77, closing the three residuals from sol's round-3 MERGE
verdict:

- The qualified-constructor pattern gains a leading (?<!\w) so prefixed
  identifiers (notpolicyengine_us.Microsimulation) cannot false-positive.
- MICROSIM_KNOWN_MISSES pins the guard's documented blind spots as five
  corpus entries (backslash continuation before import, hybrid
  backslash-then-paren import, aliased constructor, import *, dot-split
  qualified constructor) with a test asserting they are NOT caught — a
  future tightening moves entries to MICROSIM_BANNED_SAMPLES. The module
  docstring now states exactly what is caught vs missed.
- The plugin-maintenance skill's documented scan-suffix list adds
  .ipynb, matching SCAN_SUFFIXES.

uv run pytest --ignore=tests/test_skill_examples.py: 97 passed.
Wrapper smoke build: OK.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@MaxGhenis
MaxGhenis merged commit 2fd13d5 into main Aug 2, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant