From a70197f8e317c1089d454e2609d8d6231b8869fe Mon Sep 17 00:00:00 2001 From: forge Date: Sun, 25 Oct 2026 06:07:53 +0000 Subject: [PATCH] forge: pin check_lint_classes DRY verifier to pre-refactor blob e4bf8f7d (fix vacuous equivalence) --- ..._LINT_CLASSES_BLOB_PIN_FIX_VERIFICATION.md | 124 ++++++++++++++++++ .../forge/verify_check_lint_classes_dry.py | 33 ++++- 2 files changed, 152 insertions(+), 5 deletions(-) create mode 100644 wizard-work/forge/CHECK_LINT_CLASSES_BLOB_PIN_FIX_VERIFICATION.md diff --git a/wizard-work/forge/CHECK_LINT_CLASSES_BLOB_PIN_FIX_VERIFICATION.md b/wizard-work/forge/CHECK_LINT_CLASSES_BLOB_PIN_FIX_VERIFICATION.md new file mode 100644 index 0000000..57a1aef --- /dev/null +++ b/wizard-work/forge/CHECK_LINT_CLASSES_BLOB_PIN_FIX_VERIFICATION.md @@ -0,0 +1,124 @@ +# CHECK_LINT_CLASSES_BLOB_PIN_FIX — Verification Record (forge lane: Refactor) + +## Subject + +`wizard-work/forge/verify_check_lint_classes_dry.py` — equivalence proof for the +`report()` Counter-tally DRY refactor in `tools/check_lint.py`. + +## Defect (measured, not claimed) + +The verifier committed a vacuous equivalence: `orig_text()` read +`git show HEAD:tools/check_lint.py`, but the Counter refactor to `tools/check_lint.py` +was introduced in commit `4f76eaa` **together with this verifier** +(`git show 4f76eaa --stat`: `tools/check_lint.py | 9 -+`, +`verify_check_lint_classes_dry.py | 252 +`). Because the refactor is in `HEAD`, +"original" (`HEAD:tools/check_lint.py`) and "refactored" (working tree) were the +same blob, so the verifier compared a file with itself: + +- pre-refactor blob `4f76eaa^:tools/check_lint.py` = `e4bf8f7db20c7dc8fc04a89b6923633b6544de1e` + (has the tally line as live code, **no** `from collections import Counter`) +- refactored blob (`4f76eaa` and `HEAD` = `565070d`) = `d8c1b6c897e062e08b8eb9fcd4def67f065302c6` + (tally line removed from code, replaced by `dict(Counter(...))`, Counter import added) + +Result: `orig_text()` returned the **refactored** source, so legs [4a]/[4d] were +doomed to FAIL — `4f76eaa~1 e4bf8f7d vs d8c1b6c8` is a blob compared with itself. + +### Before-fix run (measured output, verbatim) + +``` + [ok ] [1] selftest: original (HEAD) 37/37 rc 0 + [ok ] [2] selftest: refactored 37/37 rc 0 + [ok ] [3] selftest: stdout BYTE-IDENTICAL + [FAIL] [4a] code-level: original HAS tally line + [ok ] [4b] code-level: refactored HAS NO tally line + [ok ] [4c] code-level: refactored HAS Counter import + [FAIL] [4d] code-level: original HAS NO Counter import + ... +verify: 11 checks, 9 passed, 2 failed +VERDICT: MISMATCH -- behavior NOT preserved +exit 1 +``` + +## Fix + +`orig_text()` now pins the true pre-refactor baseline by content: + +- `ORIG_REF = "4f76eaa^"` — reads `4f76eaa^:tools/check_lint.py` (the commit's + parent, which is reachable / GC-safe for the life of the repo). +- `ORIG_BLOB = "e4bf8f7db20c7dc8fc04a89b6923633b6544de1e"` — the documented + pre-refactor sha, asserted by a content self-check: the sha-1 of the material + returned by `git show` must equal `ORIG_BLOB`, else `orig_text()` raises + `Mismatch`. A force-push that rewrites `4f76eaa^` fails loudly instead of + silently grading the wrong file. +- `ref_text()` is unchanged — it reads the working tree, which is the refactor + under test (correct DRY semantics: a future working-tree edit to + `tools/check_lint.py` is graded against this real baseline). + +Docstring leg label [1] updated from `original (HEAD)` to `original (pinned 4f76eaa^)`. + +### After-fix run (measured output, verbatim) + +``` + [ok ] [1] selftest: original (pinned 4f76eaa^) 37/37 rc 0 + [ok ] [2] selftest: refactored 37/37 rc 0 + [ok ] [3] selftest: stdout BYTE-IDENTICAL + [ok ] [4a] code-level: original HAS tally line + [ok ] [4b] code-level: refactored HAS NO tally line + [ok ] [4c] code-level: refactored HAS Counter import + [ok ] [4d] code-level: original HAS NO Counter import + [ok ] [4e] code-level: refactored HAS Counter expr + [ok ] [5] report() stdout BYTE-IDENTICAL (incl. classes repr) + [ok ] [6] report() --json payload BYTE-IDENTICAL (excl. generated_utc) + [ok ] [7] non-vacuity: fixture tallied >1 distinct class + +verify: 11 checks, 11 passed, 0 failed +VERDICT: ALL GREEN -- report() behavior preserved +exit 0 +``` + +## Non-vacuity proof (sabotage, two angles) + +Both angles are minimal edits to the FIXED verifier, derived in +`/root/.hermes/profiles/forge/cache/scratch/probe_nonvacuity.py`. + +### Angle A — self-check guard vs a wrong pin + +Set `ORIG_REF="HEAD"` (keep `ORIG_BLOB` = real pre-refactor sha). The content +self-check detects that `HEAD:tools/check_lint.py` hashes to `d8c1b6c8`, not +`e4bf8f7d`, and raises before grading: + +``` +VERDICT: MISMATCH -- pre-refactor blob drifted from e4bf8f7db20c7dc8fc04a89b6923633b6544de1e +exit 1 +``` + +=> the verifier rejects a wrong pin instead of silently self-comparing. + +### Angle B — code-level legs [4a]/[4d] are the real guard + +Bypass the self-check (`ORIG_REF="HEAD"` **and** `ORIG_BLOB=d8c1b6c8` so the +content check passes). `orig_text()` then returns the refactored source as +"original"; legs [4a] and [4d] FAIL exactly as they did before the fix: + +``` + [FAIL] [4a] code-level: original HAS tally line + [FAIL] [4d] code-level: original HAS NO Counter import +verify: 11 checks, 9 passed, 2 failed +VERDICT: MISMATCH -- behavior NOT preserved +exit 1 +``` + +=> [4a]/[4d] discriminate the genuine pre-refactor blob from the refactored one; +they are not tautologies. + +## Artifacts + +- Modified: `wizard-work/forge/verify_check_lint_classes_dry.py` (the verifier) +- Unchanged source under test: `tools/check_lint.py` (the refactored Counter tally; + behavior preserved — legs [5]/[6] byte-identical) + +## Verdict + +`verify_check_lint_classes_dry.py` now grades the true pre-refactor blob +(`e4bf8f7d` at `4f76eaa^`), not HEAD. All 11 legs pass; the two previously +vacuous legs [4a]/[4d] are proven non-vacuous by sabotage. diff --git a/wizard-work/forge/verify_check_lint_classes_dry.py b/wizard-work/forge/verify_check_lint_classes_dry.py index 17a08fe..62082e0 100644 --- a/wizard-work/forge/verify_check_lint_classes_dry.py +++ b/wizard-work/forge/verify_check_lint_classes_dry.py @@ -21,7 +21,7 @@ as the hand-rolled loop; and re-assigning the EXISTING "classes" key keeps its position in `summary` (CPython 3.7+), so the SUMMARY line order is unchanged. LEGS (exit 0 iff all pass, else 1): - [1] selftest: original (HEAD) 37/37 rc 0 + [1] selftest: original (pinned 4f76eaa^) 37/37 rc 0 [2] selftest: refactored (working tree) 37/37 rc 0 [3] selftest: stdout BYTE-IDENTICAL (original == refactored) [4] code-level: original HAS the tally line & no Counter import/expr; @@ -49,17 +49,40 @@ IMP = "from collections import Counter" EXPR = 'dict(Counter(g["class"] for g in graded))' TMPBASE = os.environ.get("TMPDIR", tempfile.gettempdir()) +# The Counter-tally DRY refactor to tools/check_lint.py first landed in commit +# 4f76eaa, committed *together* with this verifier. Reading "HEAD:tools/check_lint.py" +# for the pre-refactor original was therefore circular: HEAD already *is* the +# refactored source, so original and refactored were one file compared with itself +# and legs [4a]/[4d] could never pass (vacuous equivalence -- a file compared with +# itself). Pin the true pre-refactor baseline by its content: the blob e4bf8f7d +# as held at 4f76eaa^, which is reachable (GC-safe) via that commit and asserted +# by the self-check in orig_text() below. +ORIG_REF = "4f76eaa^" +ORIG_BLOB = "e4bf8f7db20c7dc8fc04a89b6923633b6544de1e" + class Mismatch(Exception): pass def orig_text(): - """Committed pre-refactor source = HEAD (the refactor is a working-tree change).""" - p = subprocess.run(["git", "-C", REPO, "show", "HEAD:" + TOOL], + """Pre-refactor source, pinned to ORIG_REF (blob ORIG_BLOB). + + Reads the committed pre-refactor baseline (``4f76eaa^:tools/check_lint.py``) + rather than HEAD, because the refactor itself is committed at HEAD -- reading + HEAD made original == refactored and turned [4a]/[4d] into a vacuous + comparison of a blob with itself. A content self-check confirms the pinned + blob still matches ORIG_BLOB, so a force-push history rewrite fails loudly + instead of silently grading the wrong file. + """ + p = subprocess.run(["git", "-C", REPO, "show", ORIG_REF + ":" + TOOL], capture_output=True, text=True, timeout=60) if p.returncode != 0: - raise Mismatch("cannot read HEAD:" + TOOL) + raise Mismatch("cannot read %s:%s" % (ORIG_REF, TOOL)) + chk = subprocess.run(["git", "-C", REPO, "hash-object", "--stdin"], + input=p.stdout, capture_output=True, text=True, timeout=60) + if chk.returncode != 0 or chk.stdout.strip() != ORIG_BLOB: + raise Mismatch("pre-refactor blob drifted from %s" % ORIG_BLOB) return p.stdout @@ -194,7 +217,7 @@ def main(): # ---- [1-3] selftest parity ------------------------------------------------ rc_o, out_o = run_selftest(orig) rc_r, out_r = run_selftest(ref) - check("[1] selftest: original (HEAD) 37/37 rc 0", + check("[1] selftest: original (pinned 4f76eaa^) 37/37 rc 0", rc_o == 0 and SUMMARY in out_o, "rc=%d" % rc_o) check("[2] selftest: refactored 37/37 rc 0",