Q47 CLOSED (Merlin): the read path — a subject the interpreter can run neither crashes the gate nor is falsely refused
The subject's source is now read the way CPython reads it: bytes through tokenize.detect_encoding (BOM stripped, PEP 263 cookie honoured), with a dated exit-2 refusal for a file that cannot be read that way, at Q46's guard point — after Q35's precondition, before the admission probe, before any leg, before any sandbox. All four subject-source reads route through the one reader; one stderr NOTE when the encoding is not plain utf-8; the Q46 parse guard, the Q45 redirect, every check() and the 169 count untouched. Deliverable recoveries/helm-read-path-guard.md (12,821 B), scratch tree /root/crucible/q47/, evidence out/Q47-NEGATIVES.json (21 rows), out/Q47-VERDICT.json, out/Q47-GREEN.json, out/DIFF-vs-q46.txt. Measured, not asserted: latin-1 cookie subject rc 0 / 169 passed / ALL GATES PASS under the shipped gate (Q39-Q45 crash with UnicodeDecodeError); BOM'd collector rc 0 / 169 passed (Q43/Q45 SyntaxError at the sandbox copy, Q44 AttributeError, sandboxes left); genuinely undecodable subject rc 2 with the dated Q47 REFUSAL and no sandbox. Q39 runs the BOM subject green with 164 passed — the read-path class is the text-compiling gates (Q43-Q46), not subject handling generally. Green pair 5x rc 0, 169/0, 13,312 B stdout / 425 B stderr, live and held delta 0 on all 26 invocations. Adoption pair moves to collector 4e45021d + gate 76f2292b. Nothing deployed, no cp into /root/.helm/bin/, decisions/ and inbox/ untouched, no another-party file edited, no secret. Run 13 in the check-in; queue block appended.
This commit is contained in:
Merlin committed
1 parent
c104fbbc58
commit
8cb941fc26
3 files changed
+313
No files matched your search
@@ -6632,3 +6632,22 @@ Deliverable `recoveries/helm-parse-guard.md` (12,284 B / sha256 `19fa3ff6d25c85c
|
|||||||
Zeph). The wake was self-caused — the pipe's `1ef1089` plus the control plane's `06af851`/`1478ce9`/`4b9de3f` — and
|
Zeph). The wake was self-caused — the pipe's `1ef1089` plus the control plane's `06af851`/`1478ce9`/`4b9de3f` — and
|
||||||
was verified before this entry was written: 92/92 watched paths hash-identical to HEAD, 0 open PRs, one ref `main`,
|
was verified before this entry was written: 92/92 watched paths hash-identical to HEAD, 0 open PRs, one ref `main`,
|
||||||
and no counterparty path in any commit since Merlin's `29cea30`.
|
and no counterparty path in any commit since Merlin's `29cea30`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Q47 (Helm lane) — CLOSED 2026-10-13 by Merlin. A subject the interpreter can run neither crashes the gate nor is falsely refused; the read path is now the read the interpreter itself does.**
|
||||||
|
|
||||||
|
Deliverable `recoveries/helm-read-path-guard.md` (12,821 B / sha256 `5bf9ba115071a97f07a4d6e09bd4d4add78646680724ff63e32f2d101cdc1516`), scratch tree `/root/crucible/q47/`, harness `run_negatives_q47.py` → `out/Q47-NEGATIVES.json` (57,247 B, 21 rows, `generated_at 2026-10-13T03:46:55.002706+00:00`), verdict `out/Q47-VERDICT.json` (recomputed from the rows by `recompute_verdict.py`), green pair `run_green_q47.py` → `out/Q47-GREEN.json` (2,725 B) with logs `out/q47-green-{1..5}.{out,err}`, diff `out/DIFF-vs-q46.txt`. Nothing deployed, no `cp` into `/root/.helm/bin/`, `decisions/` and `inbox/` untouched, no another-party file edited, no secret.
|
||||||
|
|
||||||
|
- **The pair.** Collector **byte-identical to Q46's** (`4e45021d80395d3f…`, 720 / 29,954, measured by sha256) — every change is in the gate. Gate **`76f2292b9a6cad08…`** (**115,182 B / 2,124 lines**) against Q46's `ae69d5dd…` (110,509 / 2,032); `diff -u` = **130 lines = 2 file + 4 hunk + 96 added + 4 removed + 24 context**, and 2,032 + 96 − 4 = 2,124 exactly.
|
||||||
|
- **One reader, four read sites, one refusal.** `_q47_subject_text()` reads the subject the CPython way: bytes through `tokenize.detect_encoding` (BOM first, then the PEP 263 cookie, then utf-8), decoding with `utf-8-sig` when a BOM is present so it is stripped exactly as the interpreter strips it. A dated exit-2 refusal sits at Q46's guard point — after Q35's source precondition, before the admission probe, before any leg, before any sandbox. All four subject-source reads (Q35's `_q35_src`, the admission's `_q39_src_text`, the G8 source read, the G8 source-guard check) route through the one reader. One `Q47 NOTE` on stderr, never stdout, and only when the encoding is not plain utf-8. The Q46 guard, the Q45 redirect, every `check()` and the 169 count are untouched.
|
||||||
|
- **The interpreter's own verdict, measured not assumed** (`make_fixtures.py`, fixtures from the real collector with asserted counts): `collector-latin1.py` (30,028 B / `6ce8bf90292d83f1…`, cookie + one `0xe9` in a comment) → `python3 <fixture> --skip-tests` **rc 2**, the destination rule — the file **runs**; `collector-bom.py` (29,957 B / `d14906c868e24997…`) → **rc 2**, runs; `collector-undecodable.py` (30,006 B / `47fc3580fdfe8308…`, one `0xe9`, no cookie) → **rc 1**, `SyntaxError: Non-UTF-8 code starting with '\xe9'`.
|
||||||
|
- **The discriminator, fifteen invocations, five gates** (legacy gates digest-verified `9b09f328…` / `c22601ec…` / `18580c10…` / `2bbca218…`): latin-1 — Q39/Q43/Q44/Q45 all **rc 1** with `UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe9 in position 30026` (0.13–0.16 s, no sandbox), **Q47 rc 0 / 169 passed / ALL GATES PASS / 13,312 B / 12.44 s** with the `iso-8859-1` NOTE; BOM — **Q39 rc 0 / 164 passed / ALL GATES PASS / 11,398 B / 10.12 s**, Q43/Q44/Q45 **rc 1** (SyntaxError at the sandbox copy for Q43/Q45, `AttributeError: 'NoneType' object has no attribute 'body'` for Q44; 575/0/575 B; sandboxes `legacy/q43/helm-legs-_sja2yko`, `legacy/q44/helm-legs-sl1v6yx5`, `legacy/q45/helm-legs-8qmmr11u` left — C2 again), **Q47 rc 0 / 169 passed / 13,312 B / 12.22 s** with the `utf-8-sig` NOTE; undecodable — all four legacy gates rc 1 `UnicodeDecodeError … position 30004`, **Q47 rc 2 / stdout 0 B** with the dated `Q47 REFUSAL: … cannot be read the way CPython reads a source file - 'utf-8' codec can't decode byte 0xe9 in position 30004: invalid continuation byte - refused at 2026-10-13T03:47:32.685519+00:00, before the admission probe, before any leg, and before any sandbox is created.` — no traceback, no leftover.
|
||||||
|
- **The done-criteria, all measured:** the latin-1 subject proceeds past the guard and runs the whole suite green; the BOM subject is not refused and runs green; a genuinely undecodable subject is a dated exit-2 refusal on the shipped gate (the four pre-Q46 gates stay frozen controls at rc 1, measured not patched); green still **169 passed / 0 failed**; **no sandbox left**; **`live_delta` = 0 and `live_held_delta` = 0 on all 21 rows**.
|
||||||
|
- **The Q39-bom row is a finding:** the oldest gate runs the BOM subject **green with 164 passed** while Q43/Q44/Q45 crash on it, because Q39 never compiles the subject's text (its own report prints `parse line -: the subject does not parse: invalid non-printable character U+FEFF` and continues). The read-path class is a property of the gates that compile the subject's **text** — Q43/Q45's sandbox-copy import, Q44's `ast` — not of subject handling generally.
|
||||||
|
- **Regression, all still refused:** `q47-q46reg-noparse` rc 2 with the dated `Q46 REFUSAL` unchanged; `q47-neg-n1…n5` all rc 2, live delta 0. The read-path fix did not loosen the parse guard or the admission.
|
||||||
|
- **Green pair, five consecutive invocations:** rc 0 each, 169 passed / 0 failed, ALL GATES PASS, **13,312 B stdout / 425 B stderr**, 12.03–12.58 s, live delta 0, no leftover; stdout digests `21920260cade855a…` / `580021754ed55d3d…` / `49025d65cc3082e5…` / `c8155f076d214d24…` / `1d2c7d69a8531d39…`. `out/q47-green-1.out` vs Q46's green log: **184 lines each, exactly 4 differ, all four randomized names** (the `/tmp` render dest, the deploy temp dir, the two sandbox-path lines) — the read path changed nothing the suite prints.
|
||||||
|
- **Live state, delta 0 across all 26 invocations** (21 harness rows + 5 green runs), censused on (bytes, sha256, mtime_ns, ctime_ns): snapshot **14,039 B / `aa842b0fd88037f8…`** / mtime_ns `1791479579475780303` / ctime_ns `1791789490146606356`; held pin **120 B / `5b6d70716153c3f4…`** / mtime_ns `1791478687099553071` / ctime_ns `1791846636217687791` (the Q45 restore's trace). Deployed bin untouched (`ee0b36a82f23fcf3…` / `7ed1bca8f9da624f…` / `5c67473d89283c3d…`, plus `helm-validate.py` `12570786ba703787…`, `summarize.py` `7386999867789694…`). Final tree: **0 sandboxes**.
|
||||||
|
- **Limits and defects, logged first in the deliverable:** the harness's verdict block passed fixture names **with** `.py` into a row-name builder that strips it, so the verdict raised `StopIteration` → `RuntimeError` after the rows JSON was written (recomputed from the rows by `recompute_verdict.py`; `run_negatives_q47.py` patched; no gate invocation re-run); the negative fixtures' destination literals still name the **q46** tree (inherited by `cp -a`), so the fixture-dest census was vacuous this run (no `n*-dest`/`dep-dest` directory exists under `/root/crucible/q46/fixtures`, and each negative row's leg refused its own destination); the copies this gate writes are UTF-8 by construction (their header lines push the subject's cookie past PEP 263's line-2 limit), so non-ASCII in **executable strings** under a cookie would be re-encoded — recorded as a limit, not fixed; the guard stays static (runtime-generated code is out of every static guard's reach).
|
||||||
|
- **§4 consequence:** the adoption pair is now collector `4e45021d…` + gate **`76f2292b…`** (superseding `ae69d5dd…`). Q40's finding stands — the deployed gate `7ed1bca8…` reads `HELM_COLLECTOR` zero times — so the `cp` remains Alexander's and is the only thing that puts Q31–Q47's protection into production.
|
||||||
|
- **Q7, measured:** the Helm lane's executable set is empty again after this item (the adoption `cp`, Q9, Q13/Q19 and Q42 are human- or counterparty-gated). Merlin's Q45 §9 follow-on (resolve every path the subject declares **at runtime**, not only the literals it declares statically) stays open and unclaimed beside the adoption. **No new item opened.**
|
||||||
@@ -136,4 +136,137 @@ in the files it lands — the long strings are gate check names, refusal message
|
|||||||
digests. This run's commits are authored `Merlin <merlin@agents.invalid>` (`git -c`), so the monitor
|
digests. This run's commits are authored `Merlin <merlin@agents.invalid>` (`git -c`), so the monitor
|
||||||
sees them as counterparty content per Q36's v1.3 rule.
|
sees them as counterparty content per Q36's v1.3 rule.
|
||||||
|
|
||||||
|
—
|
||||||
|
---
|
||||||
|
|
||||||
|
## Run 13 — Q47: the read path
|
||||||
|
|
||||||
|
### Did
|
||||||
|
|
||||||
|
Claimed and finished **Q47 — the read path** (Helm lane; opened by the pipe on reply 30's C1, its
|
||||||
|
new `Documented` finding). Deliverable: `recoveries/helm-read-path-guard.md` (**12,821 B / sha256
|
||||||
|
`5bf9ba115071a97f07a4d6e09bd4d4add78646680724ff63e32f2d101cdc1516`**, this host). Queue block
|
||||||
|
appended to `WORK-QUEUE.md`. Scratch tree `/root/crucible/q47/`; nothing deployed, no `cp` into
|
||||||
|
`/root/.helm/bin/`, `decisions/` and `inbox/` untouched, no another-party file edited, no secret.
|
||||||
|
|
||||||
|
**The defect, both directions, one cause.** A subject with `# -*- coding: latin-1 -*-` and one
|
||||||
|
latin-1 byte — bytes-compile OK, `python3 <fixture>` rc 0, so the **interpreter runs it** — crashed
|
||||||
|
the gate at `COLLECTOR.read_text()`: UTF-8 decode raises `UnicodeDecodeError`, rc 1, a traceback, no
|
||||||
|
dated refusal. The real collector with a UTF-8 BOM — CPython strips a BOM when it reads a source
|
||||||
|
file — was **falsely refused** by the Q46 guard: the decoded text still carries U+FEFF and
|
||||||
|
`compile()` calls it an invalid non-printable character. The gate reads a decoded `str`; the
|
||||||
|
interpreter compiles the file's **bytes**.
|
||||||
|
|
||||||
|
**The pair.** Collector **byte-identical to Q46's** (`4e45021d80395d3f…`, 720 / 29,954, measured by
|
||||||
|
sha256) — every change is in the gate. Gate **`76f2292b9a6cad08…`** (**115,182 B / 2,124 lines**)
|
||||||
|
against Q46's `ae69d5dd…` (110,509 / 2,032); `out/DIFF-vs-q46.txt` = **130 lines = 2 file + 4 hunk +
|
||||||
|
96 added + 4 removed + 24 context**, and 2,032 + 96 − 4 = 2,124 exactly (the lane decomposition
|
||||||
|
rule: added = `^+` minus `+++`, removed = `^-` minus `---`).
|
||||||
|
|
||||||
|
**What changed — one reader, four read sites, one refusal.** (1) `_q47_subject_text()` reads the
|
||||||
|
subject the CPython way: bytes through `tokenize.detect_encoding` (BOM first, then the PEP 263
|
||||||
|
cookie, then utf-8), decoding with `utf-8-sig` when a BOM is present so it is stripped exactly as
|
||||||
|
the interpreter strips it. (2) A **dated exit-2 refusal** at Q46's guard point — after Q35's source
|
||||||
|
precondition, before the admission probe, before any leg, before any sandbox — with the live
|
||||||
|
snapshot read before and after. (3) All four subject-source reads routed through the one reader
|
||||||
|
(Q35's `_q35_src`, the admission's `_q39_src_text`, the G8 source read, the G8 source-guard check).
|
||||||
|
(4) One `Q47 NOTE` on **stderr**, never stdout, and only when the subject's encoding is not plain
|
||||||
|
utf-8, so a green pair's stdout shape is unchanged and the positive side is visible. The parse
|
||||||
|
guard, the redirect, every `check()` and the 169 count are untouched.
|
||||||
|
|
||||||
|
**The interpreter's own verdict, measured not assumed** (`make_fixtures.py`, fixtures built from
|
||||||
|
the real collector with asserted counts): `collector-latin1.py` (30,028 B / `6ce8bf90292d83f1…`) →
|
||||||
|
`python3 <fixture> --skip-tests` **rc 2**, the destination rule refusing — the file **runs**;
|
||||||
|
`collector-bom.py` (29,957 B / `d14906c868e24997…`) → **rc 2**, runs; `collector-undecodable.py`
|
||||||
|
(30,006 B / `47fc3580fdfe8308…`) → **rc 1**, `SyntaxError: Non-UTF-8 code starting with '\xe9'`.
|
||||||
|
|
||||||
|
**The discriminator, fifteen invocations, five gates** (`run_negatives_q47.py` →
|
||||||
|
`out/Q47-NEGATIVES.json`, 57,247 B, 21 rows, `generated_at 2026-10-13T03:46:55.002706+00:00`;
|
||||||
|
legacy gates digest-verified `9b09f328…` / `c22601ec…` / `18580c10…` / `2bbca218…`):
|
||||||
|
|
||||||
|
| fixture | Q39 | Q43 | Q44 | Q45 | **Q47 (shipped)** |
|
||||||
|
|---|---|---|---|---|---|
|
||||||
|
| `collector-latin1.py` | rc 1 — `UnicodeDecodeError … position 30026` (0.16 s) | rc 1 — same (0.13 s) | rc 1 — same (0.15 s) | rc 1 — same (0.14 s) | **rc 0, 169 passed / 0 failed, ALL GATES PASS, 13,312 B, 12.44 s**, `Q47 NOTE … (iso-8859-1)`, no leftover |
|
||||||
|
| `collector-bom.py` | **rc 0, 164 passed, ALL GATES PASS, 11,398 B, 10.12 s** (see the finding below) | rc 1 — `SyntaxError: invalid non-printable character U+FEFF` at the sandbox copy's import, 575 B, **`legacy/q43/helm-legs-_sja2yko` left** (0.61 s) | rc 1 — `AttributeError: 'NoneType' object has no attribute 'body'`, 0 B, **`legacy/q44/helm-legs-sl1v6yx5` left** (0.22 s) | rc 1 — `SyntaxError … U+FEFF`, 575 B, **`legacy/q45/helm-legs-8qmmr11u` left** (0.66 s) | **rc 0, 169 passed / 0 failed, ALL GATES PASS, 13,312 B, 12.22 s**, `Q47 NOTE … (utf-8-sig)`, no leftover |
|
||||||
|
| `collector-undecodable.py` | rc 1 — `UnicodeDecodeError … position 30004` (0.14 s) | rc 1 — same (0.14 s) | rc 1 — same (0.19 s) | rc 1 — same (0.14 s) | **rc 2, stdout 0 B (`e3b0c44298fc1c149…`)**, dated `Q47 REFUSAL: … cannot be read the way CPython reads a source file - 'utf-8' codec can't decode byte 0xe9 in position 30004: invalid continuation byte - refused at 2026-10-13T03:47:32.685519+00:00, before the admission probe, before any leg, and before any sandbox is created.` — no traceback, no leftover (0.13 s) |
|
||||||
|
|
||||||
|
The item's done-criteria, measured: the latin-1 subject proceeds past the guard and runs the whole
|
||||||
|
suite green; the BOM subject is not refused and runs green; a genuinely undecodable subject is a
|
||||||
|
dated exit-2 refusal on the shipped gate (the four pre-Q46 gates stay frozen controls at rc 1,
|
||||||
|
measured, not patched); green still 169 passed / 0 failed; no sandbox left; **`live_delta` = 0 and
|
||||||
|
`live_held_delta` = 0 on all 21 rows**.
|
||||||
|
|
||||||
|
**The Q39-bom row is a finding, not noise.** The oldest gate runs the BOM subject **green with 164
|
||||||
|
passed** while Q43/Q44/Q45 crash on it. Q39's own report says why — `parse line -: the subject does
|
||||||
|
not parse: invalid non-printable character U+FEFF` — and continues: Q39 never compiles the
|
||||||
|
subject's text; it imports the file (where CPython strips the BOM) and runs the probe copy as a
|
||||||
|
subprocess whose SyntaxError the crash detector cannot see. The read-path class is a property of
|
||||||
|
the gates that compile the subject's **text** (Q43/Q45's sandbox-copy import, Q44's `ast`), not of
|
||||||
|
subject handling generally.
|
||||||
|
|
||||||
|
**Regression, all still refused.** `q47-q46reg-noparse`: rc 2, the dated `Q46 REFUSAL` unchanged —
|
||||||
|
the read-path fix did not loosen the parse guard. `q47-neg-n1…n5`: all five Q39 negatives rc 2,
|
||||||
|
live delta 0.
|
||||||
|
|
||||||
|
**Green pair, five consecutive invocations** (`run_green_q47.py` → `out/Q47-GREEN.json`, 2,725 B;
|
||||||
|
logs `out/q47-green-{1..5}.{out,err}`): rc 0 each, **169 passed / 0 failed**, ALL GATES PASS,
|
||||||
|
**13,312 B stdout / 425 B stderr**, 12.03–12.58 s, live delta 0, no leftover; stdout digests
|
||||||
|
`21920260cade855a…` / `580021754ed55d3d…` / `49025d65cc3082e5…` / `c8155f076d214d24…` /
|
||||||
|
`1d2c7d69a8531d39…`. `out/q47-green-1.out` vs Q46's green log: **184 lines each, exactly 4 differ,
|
||||||
|
all four randomized names** (the `/tmp` render dest, the deploy temp dir, the two sandbox-path
|
||||||
|
lines) — the read path changed nothing the suite prints.
|
||||||
|
|
||||||
|
**Live state, delta 0 across all 26 invocations** (21 harness rows + 5 green runs), censused on
|
||||||
|
(bytes, sha256, mtime_ns, ctime_ns): snapshot **14,039 B / `aa842b0fd88037f8…`** / mtime_ns
|
||||||
|
`1791479579475780303` / ctime_ns `1791789490146606356`; held pin **120 B / `5b6d70716153c3f4…`** /
|
||||||
|
mtime_ns `1791478687099553071` / ctime_ns `1791846636217687791` (the Q45 restore's trace).
|
||||||
|
Deployed bin untouched (`ee0b36a82f23fcf3…` / `7ed1bca8f9da624f…` / `5c67473d89283c3d…`, plus
|
||||||
|
`helm-validate.py` `12570786ba703787…` and `summarize.py` `7386999867789694…`). Final tree:
|
||||||
|
**0 sandboxes**.
|
||||||
|
|
||||||
|
**Four defects of mine, logged first in the deliverable.** (1) The harness's verdict block passed
|
||||||
|
fixture names **with** `.py` into a row-name builder that strips it, so the verdict raised
|
||||||
|
`StopIteration` → `RuntimeError` **after** the rows JSON was written; the verdict was recomputed
|
||||||
|
from the rows by `recompute_verdict.py` and `run_negatives_q47.py` is patched (the strip) — no gate
|
||||||
|
invocation was re-run. (2) The negative fixtures' destination literals still name the **q46** tree
|
||||||
|
(inherited by `cp -a`), so this run's fixture-dest census was vacuous; evidence no cross-tree write
|
||||||
|
happened: `ls /root/crucible/q46/fixtures` shows no `n*-dest`/`dep-dest` directories, and each
|
||||||
|
negative row's stderr shows the leg refusing its own destination. (3) The copies this gate writes
|
||||||
|
are UTF-8 by construction (their header lines push the subject's cookie past PEP 263's line-2
|
||||||
|
limit), so non-ASCII in **executable strings** under a cookie would be re-encoded — the fixture
|
||||||
|
carries its byte in a comment only; recorded as a limit, not fixed. (4) The guard stays static —
|
||||||
|
runtime-generated code is out of every static guard's reach (carried from Q46).
|
||||||
|
|
||||||
|
### Blocked
|
||||||
|
|
||||||
|
Nothing in my lane. Same standing gates, all Alexander's: the **§4 adoption `cp`** — now collector
|
||||||
|
`4e45021d…` + gate **`76f2292b…`** (superseding `ae69d5dd…`); Q40's finding stands (the deployed gate
|
||||||
|
`7ed1bca8…` reads `HELM_COLLECTOR` zero times), so none of Q31–Q47's protection is in production
|
||||||
|
until it lands — Q9 (checksum handover), Q13 (wording fixes), Q19 (wizard onboarding), Q42
|
||||||
|
(zephyrus's).
|
||||||
|
|
||||||
|
### Next
|
||||||
|
|
||||||
|
1. **The pipe's verification of this run**, when it lands. Everything is re-runnable from
|
||||||
|
`/root/crucible/q47/`: `run_negatives_q47.py`, `run_green_q47.py`, `recompute_verdict.py`,
|
||||||
|
`figures_q47.py` and `show_rows_q47.py` are self-contained.
|
||||||
|
2. **Merlin's Q45 §9 follow-on stays open and unclaimed:** resolve every path the subject declares
|
||||||
|
**at runtime**, rather than rewriting the literals it declares statically. Beside the adoption
|
||||||
|
decision, that is the one Helm-side follow-on I would name.
|
||||||
|
3. **Q7, measured: the Helm lane's executable set is empty again.** The adoption, Q9, Q13/Q19 and
|
||||||
|
Q42 are human- or counterparty-gated. **No new item opened** — the next Helm unit is a decision,
|
||||||
|
not a task.
|
||||||
|
|
||||||
|
### Ask
|
||||||
|
|
||||||
|
Alexander: nothing blocking. The standing items, consolidated: (a) rule on the **§4 adoption `cp`**
|
||||||
|
— collector `4e45021d…` + gate **`76f2292b…`**, the pair that makes `python3 helm-selftest.py` green
|
||||||
|
with no environment and puts Q31–Q47's protection into production (the deployed gate today has no
|
||||||
|
subject-selection path at all); (b) the **`manifest_match` pin** decision (stale since 2026-10-08);
|
||||||
|
(c) the **Q13 publication call** (item 13's decided note — escalate, do not edit the live page —
|
||||||
|
still controls over its `proposed_action`).
|
||||||
|
|
||||||
|
Landing evidence for this run lands as its own commit after the push, over the anonymous raw path,
|
||||||
|
the same way Run 12's did.
|
||||||
|
|
||||||
— Merlin
|
— Merlin
|
||||||
@@ -0,0 +1,161 @@
|
|||||||
|
# Q47 — the read path: a subject the interpreter can run must neither crash the gate nor be falsely refused
|
||||||
|
|
||||||
|
Merlin, 2026-10-13. Helm lane. Scratch tree `/root/crucible/q47/`; nothing deployed, no `cp` into
|
||||||
|
`/root/.helm/bin/`, `decisions/` and `inbox/` untouched, no another-party file edited, no secret.
|
||||||
|
Item opened by the pipe on reply 30's C1 (2026-10-13 01:58Z), measured there on the shipped Q46 gate.
|
||||||
|
|
||||||
|
**The defect.** Two directions, one cause. (a) A subject with `# -*- coding: latin-1 -*-` and one
|
||||||
|
latin-1 byte — bytes-compile OK, `python3 <fixture>` rc 0, so the **interpreter runs it** — crashed
|
||||||
|
the gate at `COLLECTOR.read_text()`: UTF-8 decode raises `UnicodeDecodeError`, rc 1, a traceback, no
|
||||||
|
dated refusal. (b) The real collector with a UTF-8 BOM — bytes-compile OK, because CPython strips a
|
||||||
|
BOM when it reads a source file — was **falsely refused** by the Q46 guard: the decoded text still
|
||||||
|
carries U+FEFF and `compile()` calls it an invalid non-printable character. The cause in both cases:
|
||||||
|
the gate reads a decoded `str`, the interpreter compiles the file's **bytes**.
|
||||||
|
|
||||||
|
## 1. The pair
|
||||||
|
|
||||||
|
Collector **byte-identical to Q46's** (`4e45021d80395d3f…`, 720 lines / 29,954 B) — measured by
|
||||||
|
sha256, not asserted. Every change is in the gate.
|
||||||
|
|
||||||
|
| | Q46 | Q47 |
|
||||||
|
|---|---|---|
|
||||||
|
| sha256 | `ae69d5dd735b6f3cfe82b3682b02acf4557b2939d104b9f15b81cffaeef016d4` | `76f2292b9a6cad08505956787cf05e65e3edaf7e0f23f73f4aed2e59a62866c1` |
|
||||||
|
| bytes | 110,509 | 115,182 |
|
||||||
|
| lines | 2,032 | 2,124 |
|
||||||
|
|
||||||
|
`out/DIFF-vs-q46.txt` (fresh `diff -u`): **130 lines = 2 file headers + 4 hunk headers + 96 added +
|
||||||
|
4 removed + 24 context**, and 2,032 + 96 − 4 = **2,124** exactly. The decomposition convention is
|
||||||
|
the lane rule: added = `^+` lines minus the `+++` header, removed = `^-` minus `---`.
|
||||||
|
|
||||||
|
## 2. What changed — one reader, four read sites, one refusal
|
||||||
|
|
||||||
|
1. **`_q47_subject_text(path)`** reads the subject the way CPython reads a source file: the file's
|
||||||
|
**bytes** through `tokenize.detect_encoding` (BOM first, then the PEP 263 cookie, then utf-8),
|
||||||
|
decoding with `utf-8-sig` when a BOM is present so the BOM is stripped exactly as the
|
||||||
|
interpreter strips it. A non-file path returns `("", "utf-8")`, the shape Q35's marker check
|
||||||
|
expects. An unreadable cookie or bytes that do not decode raise `_Q47ReadError`.
|
||||||
|
2. The **dated exit-2 refusal** sits at the same point as Q46's guard — after Q35's source
|
||||||
|
precondition, before the admission probe, before any leg, before any sandbox is created — with
|
||||||
|
the live snapshot read before and after and the delta printed. A file that cannot be read the
|
||||||
|
CPython way cannot be run by the interpreter either, so refusal is the honest shape.
|
||||||
|
3. **All four subject-source reads are routed through the one reader**: the Q35 precondition's
|
||||||
|
`_q35_src` (line 210), the admission's `_q39_src_text` (was line 361), the G8 source read (was
|
||||||
|
1704), and the G8 source-guard check (was 1971). No `read_text()` on the subject survives.
|
||||||
|
4. One **`Q47 NOTE` on stderr, never stdout, and only when the subject's encoding is not plain
|
||||||
|
utf-8** — so a green pair's stdout shape is unchanged and the positive side of a read-path fix
|
||||||
|
is visible rather than inferred (the Q38 precedent).
|
||||||
|
5. The **Q46 parse guard, the Q45 redirect, every `check()` and the suite count are untouched**: the
|
||||||
|
guard compiles the same `_q35_src` it always did — it now compiles what the interpreter would
|
||||||
|
compile. Green stays **169 passed / 0 failed**; the guard registers no check.
|
||||||
|
|
||||||
|
## 3. The fixtures, and the interpreter's own verdict (measured, not assumed)
|
||||||
|
|
||||||
|
`make_fixtures.py` builds the three from the **real collector** (digest asserted against
|
||||||
|
`4e45021d…`), each construction asserting its own counts:
|
||||||
|
|
||||||
|
| fixture | construction | `python3 <fixture> --skip-tests` (the ground truth) |
|
||||||
|
|---|---|---|
|
||||||
|
| `collector-latin1.py` (30,028 B / `6ce8bf90292d83f1…`) | cookie on line 1, one `0xe9` in a trailing comment | **rc 2** — the destination rule refuses; the file **runs** |
|
||||||
|
| `collector-bom.py` (29,957 B / `d14906c868e24997…`) | UTF-8 BOM prepended, no cookie | **rc 2** — the destination rule refuses; the file **runs** |
|
||||||
|
| `collector-undecodable.py` (30,006 B / `47fc3580fdfe8308…`) | one `0xe9` in a trailing comment, **no** cookie | **rc 1** — `SyntaxError: Non-UTF-8 code starting with '\xe9'` |
|
||||||
|
|
||||||
|
## 4. The discriminator — fifteen invocations, five gates
|
||||||
|
|
||||||
|
`run_negatives_q47.py` → `out/Q47-NEGATIVES.json` (57,247 B, 21 rows, `generated_at
|
||||||
|
2026-10-13T03:46:55.002706+00:00`); verdict in `out/Q47-VERDICT.json` (recomputed from the rows by
|
||||||
|
`recompute_verdict.py` — see §7 defect 1). Legacy gates digest-verified against the Q46 record
|
||||||
|
(`9b09f328…`, `c22601ec…`, `18580c10…`, `2bbca218…`).
|
||||||
|
|
||||||
|
| fixture | Q39 | Q43 | Q44 | Q45 | **Q47 (shipped)** |
|
||||||
|
|---|---|---|---|---|---|
|
||||||
|
| `collector-latin1.py` | rc 1 — `UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe9 in position 30026` (0.16 s, no sandbox) | rc 1 — same (0.13 s) | rc 1 — same (0.15 s) | rc 1 — same (0.14 s) | **rc 0, 169 passed / 0 failed, `VERDICT: ALL GATES PASS`, 13,312 B stdout, 12.44 s**, `Q47 NOTE … (iso-8859-1)`, no leftover |
|
||||||
|
| `collector-bom.py` | **rc 0, 164 passed, ALL GATES PASS, 11,398 B, 10.12 s** — Q39 runs the BOM subject **green** (see §6) | rc 1 — `SyntaxError: invalid non-printable character U+FEFF` at the sandbox copy's import (`\ufeff"""The Helm — P0 collector.`), 575 B, **`legacy/q43/helm-legs-_sja2yko` left** (0.61 s) | rc 1 — `AttributeError: 'NoneType' object has no attribute 'body'` (`_q39_tree.body` on a BOM'd parse), 0 B, **`legacy/q44/helm-legs-sl1v6yx5` left** (0.22 s) | rc 1 — `SyntaxError: … U+FEFF` at the sandbox copy, 575 B, **`legacy/q45/helm-legs-8qmmr11u` left** (0.66 s) | **rc 0, 169 passed / 0 failed, ALL GATES PASS, 13,312 B, 12.22 s**, `Q47 NOTE … (utf-8-sig)`, no leftover |
|
||||||
|
| `collector-undecodable.py` | rc 1 — `UnicodeDecodeError … position 30004` (0.14 s) | rc 1 — same (0.14 s) | rc 1 — same (0.19 s) | rc 1 — same (0.14 s) | **rc 2, stdout 0 B (`e3b0c44298fc1c149…`), dated `Q47 REFUSAL: … cannot be read the way CPython reads a source file - 'utf-8' codec can't decode byte 0xe9 in position 30004: invalid continuation byte - refused at 2026-10-13T03:47:32.685519+00:00, before the admission probe, before any leg, and before any sandbox is created.`** — no traceback, no leftover (0.13 s) |
|
||||||
|
|
||||||
|
The item's four done-criteria, as measured: the latin-1 subject **proceeds past the guard and runs
|
||||||
|
the whole suite green**; the BOM subject is **not refused** and runs green; a genuinely undecodable
|
||||||
|
subject is a **dated exit-2 refusal**; the four pre-Q46 gates' rcs are measured on both fixtures
|
||||||
|
above (rc 1 crashes — frozen controls, not patched); **green still 169 passed / 0 failed**; **no
|
||||||
|
sandbox left**. `live_delta` = 0 and `live_held_delta` = 0 on **all 21 rows**.
|
||||||
|
|
||||||
|
## 5. Regression controls, all still refused
|
||||||
|
|
||||||
|
- `q47-q46reg-noparse`: the Q46 class re-measured under the Q47 gate — **rc 2**, the dated
|
||||||
|
`Q46 REFUSAL` unchanged (`invalid syntax (noparse-with-markers.py, line 13) (line 13, offset 12)`).
|
||||||
|
The read-path fix did not loosen the parse guard.
|
||||||
|
- `q47-neg-n1…n5`: all five Q39 negative fixtures **rc 2**, live delta 0 — the admission machinery
|
||||||
|
is untouched. (n5's refusal line is the Q39 NOTE plus the leg's own
|
||||||
|
`refusing to write the live snapshot … without --deploy`, rc 2, 575 B.)
|
||||||
|
|
||||||
|
## 6. The green pair, and the stdout identity
|
||||||
|
|
||||||
|
`run_green_q47.py` → `out/Q47-GREEN.json` (2,725 B), logs `out/q47-green-{1..5}.{out,err}`: five
|
||||||
|
consecutive **rc 0**, **169 passed / 0 failed**, `VERDICT: ALL GATES PASS`, **13,312 B stdout /
|
||||||
|
425 B stderr** each, 12.03–12.58 s, live delta 0, held delta 0, no leftover. Green stdout digests:
|
||||||
|
`21920260cade855a…` / `580021754ed55d3d…` / `49025d65cc3082e5…` / `c8155f076d214d24…` /
|
||||||
|
`1d2c7d69a8531d39…`.
|
||||||
|
|
||||||
|
`out/q47-green-1.out` vs `out/../q46/out/q46-green-1.out`: **184 lines each, exactly 4 differ**, and
|
||||||
|
all four are the randomized names — line 1 (`/tmp/tmpkhag_ezo/` vs `/tmp/tmpl46pgy2a/`), line 10
|
||||||
|
(the `q31-g8-deploy` temp dir) and lines 183–184 (the two sandbox-path lines, which name the tree).
|
||||||
|
So the Q47 gate's green output is **byte-identical to Q46's but for the random names** — the read
|
||||||
|
path changed nothing the suite prints.
|
||||||
|
|
||||||
|
**The Q39-bom row is a finding, not noise.** The oldest gate runs the BOM subject **green with 164
|
||||||
|
passed** while Q43/Q44/Q45 crash on it. The mechanism is visible in its own report:
|
||||||
|
`parse line -: the subject does not parse: invalid non-printable character U+FEFF` — Q39 records the
|
||||||
|
parse failure and continues, because **Q39 never compiles the subject's text**; it only imports the
|
||||||
|
file (where CPython strips the BOM) and runs the probe copy as a subprocess (whose SyntaxError the
|
||||||
|
Q46-era crash detector cannot see). The read-path class is therefore a property of the gates that
|
||||||
|
compile the subject's **text** — Q43/Q45's sandbox-copy import, Q44's `ast` — not of subject
|
||||||
|
handling generally. The BOM subject is runnable by the interpreter and green on the oldest gate; it
|
||||||
|
is Q43–Q46's text compilation that made it dangerous.
|
||||||
|
|
||||||
|
## 7. Limits and defects — mine first, logged not deleted
|
||||||
|
|
||||||
|
1. **Harness verdict bug (mine).** `row_for()` was passed `READPATH_FIXTURES` (which carry `.py`)
|
||||||
|
while the discriminator loop names rows with the suffix stripped, so the verdict's generator
|
||||||
|
raised `StopIteration` → `RuntimeError` **after** the rows JSON was written. The rows are all on
|
||||||
|
disk; the verdict was recomputed from them by `recompute_verdict.py`, and `run_negatives_q47.py`
|
||||||
|
is patched (the strip) so the file on disk is right. No gate invocation was re-run.
|
||||||
|
2. **Vacuous fixture-dest census (mine).** The negative fixtures' destination literals still name
|
||||||
|
the **q46** tree — `cp -a` inherited fixtures already retargeted by q46's `setup_fixtures.py` —
|
||||||
|
so this run's `fixture_dest_census()` (which watches `q47/fixtures`) was empty on every row.
|
||||||
|
Evidence no cross-tree write happened: `ls /root/crucible/q46/fixtures` shows **no**
|
||||||
|
`n1-dest…n5-dest`/`dep-dest` directories, and each negative row's stderr shows the leg refusing
|
||||||
|
its own destination. The right fix was to re-run `setup_fixtures.py` retargeted into
|
||||||
|
`q47/fixtures`.
|
||||||
|
3. **The copies are UTF-8 by construction (recorded limit).** The probe copy and the legs' sandbox
|
||||||
|
copy prepend their own header lines, which push the subject's cookie past PEP 263's line-2
|
||||||
|
limit, so a cookie subject's non-ASCII bytes in **executable strings** would be re-encoded as
|
||||||
|
UTF-8 in the copies. The fixture therefore carries its single latin-1 byte in a comment only. A
|
||||||
|
copy faithful in the subject's own encoding would need the cookie hoisted — not built.
|
||||||
|
4. **The guard is static** (carried from Q46): runtime-generated code, or a source produced by an
|
||||||
|
import hook, is out of every static guard's reach.
|
||||||
|
5. `tokenize.detect_encoding` reads the first two lines only — **faithful**, not a limit: CPython
|
||||||
|
does not honour a cookie past line 2 either.
|
||||||
|
6. Byte counts, hashes and timings are dated readings (2026-10-13 ~03:30–04:00Z).
|
||||||
|
|
||||||
|
## 8. Live state, and the §4 consequence
|
||||||
|
|
||||||
|
Censused on (bytes, sha256, mtime_ns, ctime_ns) before and after **all 26 invocations** (21 harness
|
||||||
|
rows + 5 green runs), delta 0 on every field: snapshot `/root/.helm/data/snapshot.json` **14,039 B /
|
||||||
|
`aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d`** / mtime_ns
|
||||||
|
`1791479579475780303` / ctime_ns `1791789490146606356`; held pin
|
||||||
|
`/root/.helm/data/held/stackchain-home.html.sha256` **120 B / `5b6d70716153c3f4…`** / mtime_ns
|
||||||
|
`1791478687099553071` / ctime_ns `1791846636217687791` (that ctime is the Q45 restore's trace, as
|
||||||
|
recorded there). Deployed bin untouched: `helm-selftest.py` **33,647 B / `7ed1bca8f9da624f…`**,
|
||||||
|
`helm-collect.py` `ee0b36a82f23fcf3…`, `helm-render.py` `5c67473d89283c3d…`, `helm-validate.py`
|
||||||
|
`12570786ba703787…`, `summarize.py` `7386999867789694…`. Final tree: **0 sandboxes**.
|
||||||
|
|
||||||
|
**The adoption pair is now collector `4e45021d…` + gate `76f2292b…`** (superseding `ae69d5dd…`).
|
||||||
|
Q40's finding is unchanged and is why the `cp` matters: the deployed gate `7ed1bca8…` reads
|
||||||
|
`HELM_COLLECTOR` **zero** times, so it has no subject-selection path and none of Q31–Q47's
|
||||||
|
protection is in production until the pair lands. The `cp` stays Alexander's.
|
||||||
|
|
||||||
|
## 9. Q7, measured
|
||||||
|
|
||||||
|
After this item the Helm lane's executable set is empty again: the adoption `cp`, Q9 (checksum
|
||||||
|
handover), Q13/Q19 and Q42 are human- or counterparty-gated. Merlin's Q45 §9 follow-on — resolve
|
||||||
|
every path the subject declares **at runtime**, not only the literals it declares statically —
|
||||||
|
stays open and unclaimed beside the adoption. **No new item opened.**
|
||||||
Reference in new issue
Block a user