A whole-unit canonical pass over GOVERNANCE.md "Verification Discipline", run while resolving #1149, raised thirteen findings. Five were about text #1149 had just changed and were fixed in that pull request. These eight are about the unit's other content, predate it, and are each a fleet-law edit that every carrying repository would take.
This is the second such round on this unit. #1149 itself was the first, and it was filed for the same reason: a whole-unit read produces findings on content the triggering change never touched, and folding them in would put unrelated rule changes behind that change's review.
Every claim below was measured on a Linux host unless noted.
1. grep does not have the failure the opener attributes to a pattern
a pattern that matches less still exits zero
Measured: grep 'nomatch' f.txt exits 1, grep -q exits 1, grep -c exits 1, where grep 'hello' exits 0. The construct with the attributed behavior is an in-process match, where re.findall('nomatch', 'hello') returns [] and the process still exits 0. So what exits zero is the check wrapping the pattern rather than the pattern, and the sentence names the wrong one. The unit's own "Gates, filters, and gate-like watchers fail loud" bullet states the intended rule correctly.
2. The commit-ordering sentence refuses the push it mandates
Both are committed before the push, since a capture point that gates a push refuses a tree differing from HEAD before it runs either gate, while the diff receipt above is not tracked and is recorded after the last commit instead.
The receipt is written into the working tree after the last commit, so on the ordinary reading of "a tree differing from HEAD" the tree does differ at push time and git status is dirty. The sentence is consistent only under an unstated assumption that the cleanliness check ignores untracked files. A capture point built to the letter of this sentence refuses every push that just recorded a receipt, which is every push the unit requires.
3. The commit-ordering rule outlives the only reason given for it
Which repos hold such a capture point at all is a separate question, and the rule binds whether or not one is installed.
The ordering in finding 2 is derived entirely from a capture point's behavior. In a repository with no capture point the reason is absent while the rule still binds, and the unit offers no second reason. Reported as an incomplete rule rather than guessed at.
4. The burn-down is credited to two different operations
is left to the burn-down that engine's report writes
Recording a pass writes two tracked files, that ledger and that burn-down
A reader cannot tell whether the burn-down appears as a side effect of recording a pass or only when report runs, and the commit-ordering instruction depends on knowing which.
5. Three authorities are named for the unit model with no precedence
the engine that reads that manifest is the authority on the set rather than any restatement of its rules. In the ordinary case a unit is one level-two section of a carried Markdown canonical, which is the fidelity unit spec/section-model.md declares.
The sentence immediately after declaring the engine authoritative over "any restatement of its rules" restates the rule and attributes it to a third authority. Nothing says which wins when they disagree.
6. The lint-gate bullet asserts a document it never locates
The repo documents each linter's known-working invocation, and this rule is that all of them run.
Unnamed and unlinked, asserted to exist in every carrier, and supporting an absolute instruction. The OPERATIONS.md bullet two above it gives a path for the same class of claim. A reader who does not already know where these invocations live cannot follow "all of them run".
7. The .code-workspace prohibition turns on a word the unit says is uncharacterized
Never edit an active .code-workspace file.
"active" is load-bearing and undefined, and the same bullet states "the trigger is not fully characterized (an agent's edit has caused the reload where a human's identical edit did not)". A reader cannot tell whether a given file on disk is in scope of an absolute prohibition.
8. Hub-local paths are flagged in one place out of four
The closing paragraph qualifies one path, "in the hub, not a repo-relative link since that path is hub-local and not carried into every fleet repo", while scripts/local_review.py, scripts/canonical_review.py and spec/section-model.md appear bare in the body. Having shown that it knows the distinction matters, the unit leaves a first-time carrier to read the three unflagged paths as local to their own repository. This is an intent-fidelity inconsistency inside the unit rather than a broken-link claim.
Claims the pass checked and could not fault
Worth recording so they are not re-derived: . matching \r but not \n in a regex; str.isprintable() over a codepoint floor, including that \n and \t are themselves false, exactly as the unit now warns; the heredoc behavior as #1149 restated it, byte for byte; the raw.githubusercontent.com 404 being byte-identical for a wrong path, a nonexistent ref, and a nonexistent repository; and the whole contents-API bullet, measured on a 1,445,200-byte public blob.
A whole-unit canonical pass over
GOVERNANCE.md"Verification Discipline", run while resolving #1149, raised thirteen findings. Five were about text #1149 had just changed and were fixed in that pull request. These eight are about the unit's other content, predate it, and are each a fleet-law edit that every carrying repository would take.This is the second such round on this unit. #1149 itself was the first, and it was filed for the same reason: a whole-unit read produces findings on content the triggering change never touched, and folding them in would put unrelated rule changes behind that change's review.
Every claim below was measured on a Linux host unless noted.
1.
grepdoes not have the failure the opener attributes to a patternMeasured:
grep 'nomatch' f.txtexits 1,grep -qexits 1,grep -cexits 1, wheregrep 'hello'exits 0. The construct with the attributed behavior is an in-process match, wherere.findall('nomatch', 'hello')returns[]and the process still exits 0. So what exits zero is the check wrapping the pattern rather than the pattern, and the sentence names the wrong one. The unit's own "Gates, filters, and gate-like watchers fail loud" bullet states the intended rule correctly.2. The commit-ordering sentence refuses the push it mandates
The receipt is written into the working tree after the last commit, so on the ordinary reading of "a tree differing from HEAD" the tree does differ at push time and
git statusis dirty. The sentence is consistent only under an unstated assumption that the cleanliness check ignores untracked files. A capture point built to the letter of this sentence refuses every push that just recorded a receipt, which is every push the unit requires.3. The commit-ordering rule outlives the only reason given for it
The ordering in finding 2 is derived entirely from a capture point's behavior. In a repository with no capture point the reason is absent while the rule still binds, and the unit offers no second reason. Reported as an incomplete rule rather than guessed at.
4. The burn-down is credited to two different operations
A reader cannot tell whether the burn-down appears as a side effect of recording a pass or only when
reportruns, and the commit-ordering instruction depends on knowing which.5. Three authorities are named for the unit model with no precedence
The sentence immediately after declaring the engine authoritative over "any restatement of its rules" restates the rule and attributes it to a third authority. Nothing says which wins when they disagree.
6. The lint-gate bullet asserts a document it never locates
Unnamed and unlinked, asserted to exist in every carrier, and supporting an absolute instruction. The
OPERATIONS.mdbullet two above it gives a path for the same class of claim. A reader who does not already know where these invocations live cannot follow "all of them run".7. The
.code-workspaceprohibition turns on a word the unit says is uncharacterized"active" is load-bearing and undefined, and the same bullet states "the trigger is not fully characterized (an agent's edit has caused the reload where a human's identical edit did not)". A reader cannot tell whether a given file on disk is in scope of an absolute prohibition.
8. Hub-local paths are flagged in one place out of four
The closing paragraph qualifies one path, "in the hub, not a repo-relative link since that path is hub-local and not carried into every fleet repo", while
scripts/local_review.py,scripts/canonical_review.pyandspec/section-model.mdappear bare in the body. Having shown that it knows the distinction matters, the unit leaves a first-time carrier to read the three unflagged paths as local to their own repository. This is an intent-fidelity inconsistency inside the unit rather than a broken-link claim.Claims the pass checked and could not fault
Worth recording so they are not re-derived:
.matching\rbut not\nin a regex;str.isprintable()over a codepoint floor, including that\nand\tare themselves false, exactly as the unit now warns; the heredoc behavior as #1149 restated it, byte for byte; theraw.githubusercontent.com404 being byte-identical for a wrong path, a nonexistent ref, and a nonexistent repository; and the whole contents-API bullet, measured on a 1,445,200-byte public blob.