crenshawdev/cadence-archived

Fork 0

v3.5.4 - the gate that clears itself wrong #217

Merged

john merged 53 commits from cadence/v3.5.4 into main

2026-08-18 19:15:05 +00:00

john commented

2026-08-18 19:13:43 +00:00

Owner

Closes out the v3.5.4 cycle: eight requirements, three phases, 53 commits.

EXP-02, PHS-01: a credential the 4096-byte sanitize window cut before its
@ is now redacted instead of shipped to a review provider, and
cad-phase remove refuses a git state it could not read rather than
classifying it clean and deleting phases/<N>/ recursively.
DRF-01, DRF-02, TAG-01: /cad-audit stopped FAILing a healthy repository
on three counts - a wrapped continuation line out-declaring the milestone,
version_drift firing on the rolled-forward phase the workflow declares
exempt, and tag discovery walking upward out of the caller's own project
root.
RVW-03, REL-01, ISS-01: the stakes level moves both halves of a cross-model
review panel, git.create_tag governs the land-time tag cut alone, and
issue-check's per-issue resolve loop runs under one wall-clock budget.

Every fix carries a check watched failing against the unpatched tree first.
Audit green (8/8 traced, 21/21 acceptance criteria covered), full suite 2218
passing, self-verify clean. Manifest at 3.5.4; the v3.5.4 tag is cut on main
after this merges.

Closes out the v3.5.4 cycle: eight requirements, three phases, 53 commits. - EXP-02, PHS-01: a credential the 4096-byte sanitize window cut before its `@` is now redacted instead of shipped to a review provider, and `cad-phase remove` refuses a git state it could not read rather than classifying it clean and deleting `phases/<N>/` recursively. - DRF-01, DRF-02, TAG-01: `/cad-audit` stopped FAILing a healthy repository on three counts - a wrapped continuation line out-declaring the milestone, `version_drift` firing on the rolled-forward phase the workflow declares exempt, and tag discovery walking upward out of the caller's own project root. - RVW-03, REL-01, ISS-01: the stakes level moves both halves of a cross-model review panel, `git.create_tag` governs the land-time tag cut alone, and issue-check's per-issue resolve loop runs under one wall-clock budget. Every fix carries a check watched failing against the unpatched tree first. Audit green (8/8 traced, 21/21 acceptance criteria covered), full suite 2218 passing, self-verify clean. Manifest at 3.5.4; the v3.5.4 tag is cut on main after this merges.

john added 53 commits

2026-08-18 19:13:43 +00:00

chore: open the v3.5.4 roadmap - three phases ordered by what a wrong answer costs ae73dd60ef

The prune left the Overview describing v3.5.3; it now describes this cycle.

Phase 1 carries the two whose wrong answer destroys something (#215, #136),
phase 2 the ship gate that FAILs correct docs (#210, #211, #214), phase 3 the
three flags that misdescribe their own reach (#207, #176, #181). Four new
requirement ids seeded for the issues that had none: PHS-01, RVW-03, REL-01
and ISS-01.

#187 is not a phase - this cycle satisfies it by citing issue numbers in its
own commits, which is what the v3.5.3 land could not do.

docs: capture context for phase 1 1bde12d46d

docs: plan phase 1 - What a wrong answer destroys ffeaa3f8d9

fix(1-2): renumber remove refuses a git state it could not read f4c0fc1fbf

refactor(1-1): export bodyExcerpt so its falsifier runs at unit level 63fb7e7f58

fix(1-2): gate the renumber rmSync fallback on the same .git probe 99ba45c5b5

fix(1-1): redact a URL userinfo span the sanitize window cut before its @ 534a5b385b

test(1-1): cover the cut-userinfo alternatives and their port boundary 79923e6fd6

test(1-2): PHS-01 falsifier - unreadable git state refuses, non-repo removes e7ec6e41ea

fix(1-2): the rm fallback's refusal states only what it knows 130945018f

docs(1-2): plan 2 executor report 0de13567e0

test(1-1): EXP-02 falsifier at both parametrizations, watched at ae73dd6 5af71588cd

docs(1-1): plan 1 executor report e7fea80656

Merge branch 'worktree-agent-a29493776b128184b' into cadence/v3.5.4 cd5aed6fb0

fix(1-2): close the three fail-open paths the risk gate found in the delete guard fec446ea3a

The PHS-01 guard refused an unreadable git state at the pre-flight and at the
rmSync fallback, but the classifier underneath both answered ABSENT in three
states where a repository was present:

- GIT_DIR/GIT_WORK_TREE select a repository with no lexical `.git` above the
  work tree, so the walk found nothing while an object store held the only copy.
- A probe that errored (EACCES on an unsearchable ancestor, EIO, ESTALE) took
  the same permissive arm as a probe that found nothing, so the guard itself
  failed open.
- The walk starts at the planning root and looks UP, so a repository rooted
  inside phases/<N> was invisible to it and rmSync took the nested object store
  along with the directory.

All three now answer PRESENT: the environment is read before the walk, a failed
probe is a repository we could not rule out rather than one we ruled out, and
gitDirUnder carries the nested half at the fallback. Two falsifiers cover the
first and third, both watched failing at ffeaa3f; the source row is widened to
pin the nested probe ahead of the delete as well.

fix(1-2): probe for .git in the nested scan instead of matching entry names c0b0d04aef

The re-armed review found the two halves of the delete guard disagreeing about
what `.git` matches. `gitDirAbove` has always probed with lstat, which inherits
the filesystem's own case semantics; `gitDirUnder` compared readdir entry names,
which is case-sensitive whatever the filesystem underneath does. An admin
directory stored as `.GIT` on APFS or NTFS still resolves for git and was
scanned straight past, so the nested object store went with the phase directory.

Probing per directory closes it and drops the special-case branch. Recursion
stays on `isDirectory()`, which is lstat-shaped, so a symlink is never followed
and the scan cannot leave the phase directory. A source row pins the mechanism,
since the failing state needs a case-insensitive filesystem the suite cannot
conjure on Linux.

docs(1): phase 1 summary 7af5094896

Both requirements delivered with a falsifier watched failing at ae73dd6, plus
the blocking risk_surface review's own findings closed at fec446e and c0b0d04.
The settled survivor file rides along: it is the only producer /cad-land's
unattended close has, and an uncommitted one would let a later close merge over
findings nobody halted on.

docs(1): carry the risk-gate falsifiers' watch record in the file 6ff8bcbad3

The two PHS-01 falsifiers written during the blocking `risk_surface` round
had no `WATCHED FAILING AT` header - the convention rides plan tasks, and the
gate round runs outside that loop, so nothing carried it to them. The watch
itself was real; it was the record that lived only in SUMMARY.md and
fec446e's message, neither of which travels with the test file.

Re-ran both at ae73dd6 in a scratch worktree and recorded what they showed:
each returns `ok:true` with `{"rm":"phases/3"}` among its ops there. Header
names ae73dd6, the sha observed, rather than the ffeaa3f SUMMARY asserted;
corrected SUMMARY to match.

Test comments and one sha. No behavior change.

docs: phase 1 UAT - 9 passed, 0 failed bd6688febf

docs: capture context for phase 2 f1e111fd21

docs: plan phase 2 - The ship gate that FAILs correct docs 2c8813779c

The plan gate found D-02 and AC5 unsatisfiable as written; both are amended in
CONTEXT.md and the plan Notes record why.

fix(2-1): stop a wrapped continuation line from out-declaring the milestone 58c6a4767a

activeVersion ran both scans over a truncated body: it returned the first
line-anchored version token anywhere in `### Active` and computed its loose
fallback only over the lines above that match. A token markdown wrapping left
at a line start therefore out-declared a milestone named correctly in the
section's opening sentence, and version_drift compared the wrong version
against the tag list - the 81bdb5d shape, which hard-FAILs the ship gate on
docs that are right.

Both scans now run over the whole body, and an anchored candidate is admitted
as the declaration only when it agrees with the body's first token or its line
opens a sentence rather than continuing a wrapped one. A rejected candidate
contributes nothing, so the earlier correct mention answers (D-02). The reader
is shared, so git-branch decide's naming and its already-published refusal move
with it (D-01).

docs(2-1): the DOC-02 pin's remedy names the reader, not the file 487e150380

The pin asserted the two-scan agreement property and then told the reader to
fix PROJECT.md, stating that activeVersion() and DECLARED_VERSION_RE are not
changed and that the file is what moves when it goes red. DRF-01 moved the
property into the reader, so both sentences described code that no longer
exists.

The comment now states the admission rule the reader carries and what the one
remaining red shape is - a sentence-opening admission disagreeing with the
body's first token - and the failure message routes the remedy to the reader's
rule in lib/branch-decision.mjs and this pin derived from it. Phase 2 D-03,
reversing the pin's own D-07 policy. Mechanics unchanged.

fix(2-1): bound tag discovery to the caller's own project root caf3a23d26

`git -C <dir>` discovers a repository UPWARD, and the audit asks the tag
question from `.planning` - a directory that never holds `.git` - so a project
that is not itself a repository read the tag list of whatever repository
contained it. An unrelated umbrella repo's release could FAIL the ship gate of
a project that published nothing, and could refuse it an integration branch.

readTags now takes the project root the answer must belong to, probes
`rev-parse --show-toplevel` and answers [] unless that toplevel is the root or
sits inside it, compared segment-wise on realpaths so a symlinked checkout
(/code -> /data/code here) is not read as a different project. Each caller
derives its own root (D-07): git-branch decide already holds it, cmdAudit's dir
IS the planning root so its project is the parent. Every refusal stays
permissive at [] with no new reason (D-08). A linked worktree still reads the
shared tags - its toplevel is the worktree root - and a fixture pins it.

fix(2-1): exempt the sanctioned rolled-over phase from the drift signal ca0f2edd09

The interrupted-close exemption read phase artifacts only, and a close is
sanctioned to carry work forward - milestone.md names the state. Such a phase
is byte-identical on disk to one still being worked, so version_drift fired in
the state audit.md declares exempt, with the remedy it offers ('complete the
close so no phase is left open') unreachable by construction.

The requirement rows are the only surface carrying the answer (D-04): rolling a
phase forward marks its rows Deferred, which the close already writes and this
audit already excludes from breaks. A phase whose rows are ALL Deferred stops
holding the cycle open; rows still Pending keep the gate armed, and a phase with
no rows at all is not exempt - vacuous truth there is the ordinary unplanned
mid-cycle state #87 fires on. Read off the rows parseRequirements already
produced, no second file read.

docs(2-1): state the rolled-over exit where the audit's reader looks 03895e6c4c

The version_drift bullet offered two exits, and the second - complete the close
so no phase is left open - is unreachable for a phase deliberately rolled
forward, which is the state milestone.md treats as sanctioned. The bullet now
names the third exit the seam implements: roll the work forward, honoured once
every Traceability row naming that phase is Deferred.

audit.md's weight-budgets pin moves with it in the same commit (D-11) - the
budget check is blocking in both directions.

docs(2): phase 2 summary 94577fa0f5

docs: wrap the four unwrapped Active requirement bullets d4810fff67

PHS-01, RVW-03, REL-01 and ISS-01 were authored as single 247-290 char
lines while every other bullet wraps at the file's ~79 col width. The
milestone-prune corpus test asserts every moved bullet spans more than
one line, so PHS-01 - phase 1 being complete - failed the suite. Prose
is byte-identical; only the line breaks changed.

docs: phase 2 UAT - 7 passed, 0 failed c8c31ecd9f

docs: capture context for phase 3 cc448e618d

docs: plan phase 3 - flags that do more or less than they say 478b1ffb4e

feat(3-1): level-key the tier grid, add the effort grid, return both from resolve 5e4b883caf

fix(3-1): validate the tiers and efforts grids in both directions, per level c968b0066c

fix(3-1): move the tier and effort schema defaults onto the unset sentinel b3a5515d4f

docs(3-1): rewrite the tier and effort rows in the reach table and the catalog 71b238bae0

docs(3-1): review-triggers.md takes the tier and effort off the resolve line a41f64c953

docs(3-1): settle the route-table grid count everywhere it is stated 25fd067c54

docs(3-1): the provider reach rows name the resolved tier, not a config read 9d47e87216

fix(3-1): refuse an out-of-vocabulary config tier or effort, as the gate check already does c78cbdb64e

A repo config layer arrives with a clone, and its per-trigger tier and
effort were returned verbatim on the resolve line - the two fields
review-triggers.md step 4 interpolates into the provider command, which
review-provider.mjs sends unvalidated. Same treatment as a bad gate:
warn by name, let the level's value stand.

feat(3-2): a bounded, read-only tags arm on the git-branch seam 58cb940760

fix(3-2): the milestone close decides release mode from evidence, not a flag 4a05bf1613

docs(3-2): the tag flag's words name the land-time cut that reads it de2886c45c

test(3-2): the REL-01 falsifier - one read site, and words that name it 79b337c3b9

fix(3-2): one skip rule for a close with no confirmed version 1ca00f7b28

Step 2 gave two incompatible rules: the skip fired only on empty tags
AND no version, while the ok:false halt said STOP - so a tagged project
whose user declined the proposal died at the bump instead of skipping
it. Now no confirmed version alone skips the bump, the bump never runs
without --version, and the tags probe moves ahead of the proposal so a
never-published project is not pressed toward a release.

fix(3-3): the per-issue resolve loop is bounded by one wall-clock budget dd30e524f6

test(3-3): the two behaviours the resolve budget must not break 17e58d1bae

docs(3): phase 3 summary 4ae921f41c

docs(3): AC2 names the unset sentinel the config seam actually answers 8aec00ca9c

AC2's read half asked `config.mjs get review.triggers.plan.tier` to report
the value the resolver uses at the effective stakes level. D-04 put that key
on the `null` unset sentinel and bin/config.mjs:288-291 states the matching
refusal outright: that seam does not know the stakes level and never reads
route-table.json, so answering as if it did is the same defect pointed the
other way.

What shipped is the `.gate` shape - `null` plus a warning naming
`route.mjs resolve` as the answering seam - and that is the fix for the fixed
`flagship` the criterion was written against. AC2 now states it, with the
rewording dated in place; the grids half is unchanged and held on first
check. SUMMARY records the deviation.

docs: phase 3 UAT - 7 passed, 0 failed aebbe8ed3f

chore: bump manifest to v3.5.4 + changelog 1c47128d7e

chore: prune v3.5.4 completed phases cef13b04fb

docs: close v3.5.4 - record the shipped cycle, open none, reset cursor 6efcff938d

chore: pin cad-planner start rung at xhigh

test / node-test (git, 22) (pull_request) Successful in 29s

Details

test / node-test (git, 24) (pull_request) Successful in 28s

Details

test / node-test (other, 22) (pull_request) Successful in 28s

Details

test / node-test (other, 24) (pull_request) Successful in 30s