Report unexercised semantic signals as SKIP, not PASS

[b-macker]

Summary

test_semantic_signals.sh scored five assertions as PASS when the agent send failed. Group B is gated on GK1 being set, not on it being valid, so a stale or revoked key reaches these branches — and the suite reported the semantic_stability signal green on a run that never got past authentication.

B03 was the clearest case: its message read "Semantic section check skipped" while calling pass().

Reproduction

GK1 set to an invalid key, against master:

PASS [B02] On-topic test ran (API error, non-deterministic)
PASS [B03] Semantic section check skipped (API error in B02)
PASS [C01] On-topic pair test ran (API error, non-deterministic)
PASS [C02] Off-topic shift test ran (API error, non-deterministic)
PASS [C03] Mandate alignment test ran (API error, non-deterministic)

PASS: 20  FAIL: 0  SKIP: 0  TOTAL: 20

Nothing about signal 10 or signal 11 was measured. The suite was green.

C01–C03 are the older instance

B02/B03 arrived in #118; C01–C03 predate it and are the pattern that was copied. C01 is the worst of them — it tests for a printed ERROR= before it reads SSC at all, so any caught exception scores as a satisfied assertion about a signal that never ran:

if echo "$OUTPUT" | grep -q "ERROR="; then
    pass "C01" "On-topic pair test ran (API error, non-deterministic)"
elif [ "${SSC:-}" = "0" ]; then
    ...

Fixing only the new pair would have left the source in place, so all five move together.

The distinction

"The signal did not fire" and "the signal never ran" are the same observation here, and only one of them is a result. This is the same shape as H01, L24-02, L25-03, and the two defects in my own work earlier in this campaign: an assertion satisfiable without the property holding, because absence of the bad outcome and absence of the mechanism look identical.

skip() already exists in this file and increments TOTAL, so nothing is hidden — the count stays at 20 and the skips are visible in the summary line.

Test Plan

• Ran bash run-all-tests.sh with no new failures — 441 tests, 0 unexpected failures
• bash tests/security/test_error_msg_leaks.sh — 874 checks, 0 failures
• Added/updated tests for new functionality — n/a, this corrects existing assertions
• Tested manually in the REPL — n/a

Degraded-case check (invalid GK1, the condition that produced the vacuous passes):

	before	after
B02, B03, C01, C02, C03	PASS	SKIP
totals	20 PASS / 0 SKIP	15 PASS / 5 SKIP

Paths confirmed unchanged:

• No key at all — 9 PASS / 11 SKIP, identical to master (Group B was already fully skipped when GK1 is unset)
• Valid key — untouched; only the error branches moved, every success branch is byte-identical

Related Issues

Follow-up to #118. The Termux work that surfaced this was correct in substance — test_consequence_proof.sh and test_d1_reconciliation.sh both used skip on their API-error paths, which is the right three-way form. test_semantic_signals.sh used pass, matching a C-group pattern that was already wrong.

---

Generated by Claude Code

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}