Sweep highs: UAT gate bypass, renumber decimal corruption, git-guard config downgrades #51

Merged

crenshawdev merged 3 commits from fix/sweep-highs into main

2026-07-23 15:10:42 +00:00

crenshawdev commented

2026-07-23 15:10:03 +00:00

(Migrated from github.com)

The three high-severity fixes from the post-v1.2.0 review sweep — each a silent state-corruption that reported success, each fixed with a failing-first regression test.

UAT gate bypass — renderUat now flattens every field value to one line, so verifier-authored text containing \nstatus: pass can no longer reparse as a status line and flip a failed item to pass. Closes #35
renumber decimal corruption — the insert dir-move ceiling is computed over integer phases only, so a highest phase of 2.1 no longer walks fractional indices (moving nothing it should and the one dir it must not). Closes #36
git-guard config downgrades — on_protected: "deny" is honored as an alias of refuse (matching the file's own header), and a lone-string protected_branches guards the named branch instead of silently reverting to ['main','master']; same string tolerance applied in git-publish. Closes #38

Full suite 257/257 (253 baseline + 4 new), tsc -p tsconfig.ci.json clean. All commits GPG-signed.

The three high-severity fixes from the post-v1.2.0 review sweep — each a silent state-corruption that reported success, each fixed with a failing-first regression test. - **UAT gate bypass** — `renderUat` now flattens every field value to one line, so verifier-authored text containing `\nstatus: pass` can no longer reparse as a status line and flip a failed item to pass. Closes #35 - **renumber decimal corruption** — the insert dir-move ceiling is computed over integer phases only, so a highest phase of `2.1` no longer walks fractional indices (moving nothing it should and the one dir it must not). Closes #36 - **git-guard config downgrades** — `on_protected: "deny"` is honored as an alias of `refuse` (matching the file's own header), and a lone-string `protected_branches` guards the named branch instead of silently reverting to `['main','master']`; same string tolerance applied in `git-publish`. Closes #38 Full suite 257/257 (253 baseline + 4 new), `tsc -p tsconfig.ci.json` clean. All commits GPG-signed.