release: GT-622, GT-656, GT-657 — three checks that were red for reasons no commit could fix - #443
Merged
Conversation
…ke a wrong gap title correctable (#440) GT-622: the irreversible half the board had deferred is executed — 210 orphaned `.github/workflows/ci.yml:codeql` analyses deleted from refs/heads/main (201) and refs/heads/develop (9), each DELETE preceded by a GET asserting analysis_key and results_count == 0. Alerts identical across the deletion (242 open / 82 dismissed / 60 fixed). Measuring first refuted three of the row's own claims: it was `neutral` not red since PR #250; the configuration is on `develop`, not `main`, and `main` came back clean on its own from PR #420 with all 201 orphans in place; and the 9 on `develop` were never counted. Criterion 1 observed live on this PR, not assumed. GT-656: `49-validate-gap-id-allocation` made gap titles immutable, so a board whose purpose is not lying accumulated rows whose first line lies. Fixed by turning the deferred human judgement into data — `gap-retitles.json` declares a retitle reproducing BOTH titles exactly, so a real collision later landing on the same id still fails. Declarations are classified active/spent/rot, rot is fatal, an unparseable registry is fatal, and every exemption is printed. node --test 27/27 including the negative twins. First use: GT-622's title corrected, 82 -> 210. GT-653: its "Remaining: promotion to required context" was already done — `Secret Detection (gitleaks)` is required on both branches, set went 7 -> 8. Board: 641 / 654 done, 3 in progress, 3 pending, 7 deferred.
…ix, and name the half that has none (#441) GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 turned `Security Audit` red on every branch. Attribution measured first: the dependabot PRs of 2026-08-05 were green, PR #440 of the 8th was red, and it changed 8 doc/JSON files with zero dependency files — pre-existing branch debt, not a regression. The half that had a fix: the root override already carried `js-yaml: 4.3.0`, added for an EARLIER advisory, and the new one is vulnerable through 4.3.0 inclusive — one patch short. Bumped to 4.3.1; three nested copies collapsed into the hoisted one. The half that has none: the remainder arrives through @nestjs/swagger, which pins js-yaml exactly, and all three published releases pin a vulnerable version (11.4.4 -> 4.1.1, 11.4.5 -> 4.3.0, 11.4.6 -> 5.2.1). npm overrides do not reach a nested exact pin — measured four ways, same tree every time. That experiment also REFUTES the generalisation GT-636 recorded; corrected in the catalog. `63-validate-npm-audit-gate` keeps the same HIGH threshold and requires that an advisory with no upstream fix be NAMED, with the path it arrives by. It fails on an undeclared advisory, on a declaration for a different id or path, and on a declaration whose advisory has DISAPPEARED — so the good news arrives as a red check asking for the entry's removal. Its own fixtures run in the job. Recorded for the next reader: `Trivy` flags this as a new high alert because the advisory id at that lockfile position changed. Reverting the swagger bump makes it worse — 11.4.4's js-yaml 4.1.1 carries three advisories (two HIGH) against 11.4.6's one. The revert was attempted during this work and had to be undone, so the measurement lives in the exceptions entry and in GT-657. node --test 19/19; core-api 160/160; core-domain 1704/1704; 13 guards exit 0. Board: 642 / 655 done, 3 in progress, 3 pending, 7 deferred.
…d git instead of the filesystem (#442) Three `.DS_Store` files were sitting untracked in the root, `src/` and `src/packages/`. None was tracked by git, so nothing leaves history — deleted from the working tree and the pattern added to `.gitignore`. Adding the rule was NOT enough, and that was measured rather than assumed: `03-validate-root-cleanliness` reads the filesystem, not git, so planting a `.DS_Store` after adding the rule still exited 1. Deleting was therefore not a fix — the next Finder window recreates the file and the guard goes red again on a developer's machine, for a reason no commit can address. CI always checks out fresh, which is why it survived this long. That is the failure mode GT-622 was opened to remove: a permanently red check nobody can act on. What git ignores is by definition not in the repository, so it is not what "root cleanliness" governs. Ignored entries are skipped, and both directions are observed rather than argued: planted .DS_Store -> exit 0, "35 read, 2 ignored by git, 33 checked" planted unauthorized file -> exit 1, named in the failure list planted unauthorized dir -> exit 1, named in the failure list The taxonomy is not weakened: every file a commit could actually introduce is still checked. Two paranoia rules, because this set SUBTRACTS from what is checked and a bogus answer would hollow the guard out silently: - `git check-ignore` exit 128 (no git, not a work tree) falls back to the EMPTY set, so every entry stays under the taxonomy, and it warns rather than degrading quietly. - An answer claiming package.json, .github or .harness is ignored stops the run: those are tracked by construction, so it is a broken query, not an unusual repository. The pass line reports read / ignored / checked separately, so the denominator that matters is visible instead of implied. Guards 03, 39, 40, 42 and 43 exit 0; full CI green, 30 checks.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
This was referenced Aug 8, 2026
Merged
beyondnetPeru
added a commit
that referenced
this pull request
Aug 8, 2026
GT-658 — a broken renderer accused hundreds of innocent diagrams, and nothing in the repository chose which renderer ran. `npx -y @mermaid-js/mermaid-cli` with no version, once per diagram. The install came out INCOMPLETE on a runner (`Cannot find package 'import-meta-resolve'`, which the package does declare), every diagram failed as "mermaid render failed" blamed on the document containing it, and the job burned 23m21s reaching hundreds of wrong accusations. Two defects: the tool was unpinned AND absent from package-lock.json entirely, so npm ci, npm audit, Dependabot and GT-657's audit gate were blind to it; and the guard asked about 371 diagrams before asking whether the renderer worked, so the loudest signal pointed at the only innocent party. A preflight renders one trivial diagram first. Exit 0 is not proof — a renderer that writes no SVG has not rendered. Pinned to 11.16.0. Measured on the runner before merging, both halves: broken renderer (non-existent pin) -> exit 1, ZERO wrong accusations healthy renderer (dispatched) -> 405 of 405 rendered push build on develop, the exact scenario that failed on #443 -> 405 of 405, success in 11m11s The PR's own green was refused as verification: it rendered 0 of 405, because pull_request builds scope rendering to changed files and that change touched no diagram-bearing markdown. Board: 643 / 656 done, 3 in progress, 3 pending, 7 deferred.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
developtomain: three gaps closed, and one chore that turned out to be a fourth instance of the same pattern.ci.yml:codeqlanalyses deleted frommain(201) anddevelop(9). Alerts identical across the deletion — 242 open / 82 dismissed / 60 fixed.js-yamladvisory fixed at source; the half with no upstream fix named, with its path and what was checked..DS_Storeignored, and03-validate-root-cleanlinessnow reads git rather than the filesystem.The thread none of these were opened for
All four were checks that were red or grey for reasons no commit could address — the orphaned CodeQL configuration, an advisory with no upstream fix, and a guard failing on a file macOS writes for opening a folder. Each one trains reviewers to discount red, which is what makes the next real failure invisible.
Three claims that did not survive measurement
Recorded because in each case the wrong answer was one step away:
neutralnot red since PR docs(gaps): close GT-601 on verification — a sweep of the 20 in-progress rows #250; the configuration is onrefs/heads/develop, notmain; andmaincame back clean on its own with all 201 orphans still in place. The row had been re-measured twice without any of this surfacing, because every pass checked the count and none checked the claim.overridesobject anywhere stops the top-level rule cascading. Removing them changed nothing; what blocks it is the consumer's exact pin. Corrected in its catalog entry rather than left standing.11.4.4pins ajs-yamlcarrying three advisories (two HIGH) against11.4.6's one. Counting npm's rows says revert; counting holes says do not. The measurement now lives in the exceptions entry asdoNotRevertTheSwaggerBump.Verification
node --test27/27 (GT-656) and 19/19 (GT-657); core-api 160/160; core-domain 1704/1704; guards 03, 04, 08, 09--check, 34, 39, 40, 41--execute --strict, 42, 43, 46, 47, 49, 63 andbilingual-terminology-lintall exit 0. GT-622's closure criterion was observed live on PR #440 rather than assumed.Expected red:
Trivywill flagjs-yaml 5.2.1as a new alert because this diff changespackage-lock.jsonand the advisory id at that position changed. It is not a required context and not a regression — see item 3 above.Board: 642 / 655 done, 3 in progress, 3 pending, 7 deferred.
🤖 Generated with Claude Code