From adfff7a39ae80b5397a613139f14a418238e6df7 Mon Sep 17 00:00:00 2001 From: Merlin Date: Sun, 11 Oct 2026 11:16:20 +0000 Subject: [PATCH] Q30 DONE: the renderer's entry point runs, and it refuses production by default - reproduced the defect first: python3 helm-render.py exits 1 with NameError: name 'build_page' is not defined (guard at :90-91 above def build_page at :232), same with --out, no file written - moved the __main__ guard to the end of helm-render.py (:495 of 495); --out/--as-of semantics unchanged; fixed renderer 21,766 B sha256 5c67473d89283c3d4434928dc96d45ff48a41d8f443ecc3c98e9236be8b597f9 - destination gate per the 09:21Z control-plane addendum: OUT_DEFAULT is production, so main() resolves the destination and refuses without --deploy (exit 2, message naming the path and flag); parse_args now returns (out, now, explicit_out, deploy) - gate G7: the CLI executed in a subprocess, asserting emitted bytes (exit 0, file exists, bytes equal build_page()'s at the pinned clock, byte count matches, --as-of honoured, live root untouched); production destination refused by default and by explicit --out at the prod path (resolve(), not string equality); --deploy branch exercised against a patched OUT_DEFAULT; source-order guard so the defect cannot return - gates re-run: 119 passed, 0 failed (102 before; G7 adds 17); the gate discriminates - the same command against the pre-fix file exits 1 - CONTRACT.md appended append-only: transcripts, digests, gate, and a revision note on :213-214 (deploy is now --deploy) - nothing deployed: live page 9,865 B / 427b7b54c69b18d2... and snapshot aa842b0fd88037f8... unchanged before and after every run; --deploy alone never executed --- WORK-QUEUE.md | 44 +++++++++++ checkins/2026-10-11-merlin.md | 71 +++++++++++++++++ recoveries/helm-cli-entry-point.md | 121 +++++++++++++++++++++++++++++ 3 files changed, 236 insertions(+) create mode 100644 recoveries/helm-cli-entry-point.md diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index 3086031..4aad05f 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -3785,3 +3785,47 @@ member**, Merlin first as the Helm's author and the author of the gate set. will ever refresh it: `grep -ci helm /root/.hermes/cron/jobs.json` = **0**, and no profile cron store holds a Helm job. The dead entry point above was **read from source, not executed** — running it would be a production write if the ordering were ever fixed, so the source read is the safe and sufficient evidence. + + **Status: DONE 2026-10-11 — `recoveries/helm-cli-entry-point.md` (Merlin), all four steps of the + item plus the destination gate the 09:21Z addendum added.** The Helm files are host-local + (`/root/.helm/`, outside this repo), so the record, transcripts and digests live in the check-in + and the recoveries file; both were read back over the anonymous raw path and `cmp`-checked. + + - **The defect reproduced before the fix** (measured ~09:50Z): `python3 + /root/.helm/bin/helm-render.py` → exit **1**, `NameError: name 'build_page' is not defined`, + traceback naming `:91` and `:78`; identical with `--out /tmp/helm-cli-probe.html --as-of + 2026-10-11T12:00:00Z`; no file written. Pre-fix file 18,929 B / sha256 + `00d14453d95234ef49a1d8758ab2de76143e848191331bfec38603e6263403e6`. + - **The guard moved to the end of the file** (`:495` of 495 lines, below `build_page()` at `:273`); + `--out`/`--as-of` semantics unchanged. Fixed renderer 21,766 B / sha256 + `5c67473d89283c3d4434928dc96d45ff48a41d8f443ecc3c98e9236be8b597f9`. + - **The destination is gated**, per the 09:21Z addendum: `OUT_DEFAULT` is production, so `main()` + resolves the destination and refuses a production write without `--deploy` — exit **2**, a + message naming the path and the flag — and `parse_args()` now returns + `(out, now, explicit_out, deploy)`. + - **Gate G7 added — the CLI executed in a subprocess**, asserting on emitted bytes: exit 0 on a + staged render; the file exists; its bytes equal `build_page()`'s at the same pinned clock; the + reported byte count matches the file; `--as-of` honoured; the live document root untouched; the + production destination refused both by default and by explicit `--out ` (matched by + `resolve()`, not string equality); the `--deploy` branch exercised against a **patched + `OUT_DEFAULT`**, never the real one; and a source-order guard so the Q30 defect cannot silently + return. **17 new assertions.** + - **Gates re-run: 119 passed, 0 failed, `VERDICT: ALL GATES PASS`** (102 before). The gate + discriminates: the exact G7 subprocess command run against the pre-fix file exited 1 with + `NameError`; the same command now exits 0 and emits 11,806 bytes (sha256 + `8b839754b9e33911ec6d74834e4899a8f77f71c361eec98757d6ef08ad891839`, pinned clock + `2026-10-11T12:00:00Z`, `verdict at render: 0 green / 6 not green`). + - **`CONTRACT.md` appended, append-only** (nothing above the new addendum edited): failing and + fixed transcripts, both digests, the gate description, the nothing-deployed proof, and a + revision note on `:213-214` — the one-command deploy sentence is true up to `00d14453…`; as of + `5c67473d…` deploying is `python3 /root/.helm/bin/helm-render.py --deploy`. New CONTRACT 17,657 + B / sha256 `2c527635ff96eb677e7419ef5b15516811e05cedfa1f072f84dcf67c10214f91`. + - **Nothing deployed, measured before and after every run this tick:** live page + `/var/www/alexander-whitestone/helm/index.html` 9,865 B / sha256 + `427b7b54c69b18d270288910fc810732463129f48ec4bdd7dbc75cdb22997ce4`, mtime unchanged at + `2026-10-11 08:57:14.017837233Z`; snapshot `/root/.helm/data/snapshot.json` 14,039 B / sha256 + `aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d`, mtime + `2026-10-08T17:12:59.475780303Z`. `--deploy` alone was never executed. The collector was not + re-run and no cron job was added — both remain Alexander's under §4. + - **Left with Alexander, unchanged:** deploy-or-retire, and a scheduled collect+render. Deploying + now needs the explicit `--deploy` flag; the bare command refuses. diff --git a/checkins/2026-10-11-merlin.md b/checkins/2026-10-11-merlin.md index 9616306..10a86a3 100644 --- a/checkins/2026-10-11-merlin.md +++ b/checkins/2026-10-11-merlin.md @@ -708,3 +708,74 @@ printed in this check-in or in the files it lands; the long strings in them are build-failure messages, archive prose and sha256 digests. — Merlin + +--- + +# Run 5 — Q30: the renderer's entry point, fixed and gated (Merlin, 2026-10-11 ≈09:50–11:20 UTC) + +**Claimed:** Q30 — "The renderer's entry point: the one path no gate executes" (queue line ~3678), +nominated to Merlin first as the Helm's author. Full record: `recoveries/helm-cli-entry-point.md`. + +### Did + +1. **Reproduced the defect before touching anything** (measured ~09:50Z): + `python3 /root/.helm/bin/helm-render.py` → exit **1**, `NameError: name 'build_page' is not + defined`, traceback naming `:91` and `:78`; identical with `--out /tmp/helm-cli-probe.html + --as-of 2026-10-11T12:00:00Z`; no file written (`ls: cannot access '/tmp/helm-cli-probe.html'`). + Pre-fix file 18,929 B / sha256 `00d14453d95234ef…`. +2. **Moved the `__main__` guard to the end of `helm-render.py`** (`:495` of 495 lines, below + `build_page()` at `:273`); `--out`/`--as-of` semantics unchanged. Fixed file 21,766 B / + sha256 `5c67473d89283c3d4434928dc96d45ff48a41d8f443ecc3c98e9236be8b597f9`. +3. **Added the destination gate the control plane's 09:21Z addendum required** — `OUT_DEFAULT` + *is* production, so `main()` resolves the destination and refuses a production write without + `--deploy` (exit **2**, message naming the path and the flag); `parse_args()` now returns + `(out, now, explicit_out, deploy)`. +4. **Added gate G7 — the CLI executed in a subprocess**, asserting on emitted bytes: exit 0 on a + staged render, file exists, bytes equal `build_page()`'s at the same pinned clock, byte count + reported matches the file, `--as-of` honoured, live document root untouched; the production + destination refused (default *and* explicit `--out `, matched by `resolve()`); the + `--deploy` branch exercised against a **patched `OUT_DEFAULT`**, never the real one; plus a + source-order guard so the Q30 defect cannot silently return. **17 new assertions.** +5. **CLI transcript after the fix** (exit codes from unpiped runs): + `--out /tmp/helm-cli-evidence.html --as-of 2026-10-11T12:00:00Z` → `rendered -> … (11806 + bytes)`, `render clock 2026-10-11T12:00:00+00:00`, `verdict at render: 0 green / 6 not green + (5 stale, 1 unreachable)`, exit **0**; sha256 + `8b839754b9e33911ec6d74834e4899a8f77f71c361eec98757d6ef08ad891839`. No args → refusal, exit + **2**. `--deploy --out ` → renders the staged path, exit **0**. +6. **Gates re-run: 119 passed, 0 failed, `VERDICT: ALL GATES PASS`** (102 before). The gate + discriminates: the exact G7 command run against the pre-fix file exited 1 with `NameError`. +7. **`CONTRACT.md` appended** (append-only; nothing above the new addendum edited): the failing + and fixed transcripts, both digests, the gate description, the nothing-deployed proof, and a + revision note on the `:213-214` deploy sentence — the bare command is refused as of + `5c67473d…`; deploying is now `--deploy`. New CONTRACT 17,657 B / sha256 + `2c527635ff96eb677e7419ef5b15516811e05cedfa1f072f84dcf67c10214f91`. + +### Blocked + +- **Nothing is deployed, by design.** Live page `/var/www/alexander-whitestone/helm/index.html` + unchanged at 9,865 B / sha256 `427b7b54c69b18d2…`, mtime `2026-10-11 08:57:14.017837233Z` + (that write is this lane's earlier byte-exact restore), measured before and after every run + this tick. Snapshot `/root/.helm/data/snapshot.json` unchanged at 14,039 B / sha256 + `aa842b0fd88037f8…`, mtime `2026-10-08T17:12:59.475780303Z`. `--deploy` alone was never + executed; G7 exercises it against a temp path. +- **Deploying and scheduling remain Alexander's under §4.** The honest page (0 green / 6 not + green, five false `FRESH` badges corrected) is staged at + `/tmp/helm-cli-evidence.html` (11,806 B) — one command with `--deploy`, still not run. + +### Next + +- Await Alexander on deploy-or-retire (unchanged from Run 2) and on a scheduled collect+render. +- Q30 is closed from this side; the queue Status line is appended in the same commit. + +### Ask + +**Alexander: the deploy command changed.** Deploying is now +`python3 /root/.helm/bin/helm-render.py --deploy` — the bare command is refused with exit 2, so +the sentence in `CONTRACT.md:213-214` names a revision, not a live command. Same §4 call as +before: deploy the honest page, or leave the false greens in production. + +No secret is printed in this check-in or in the files it lands; the long strings are HTML +fragments, a traceback, a refusal message and sha256 digests. `decisions/` and `inbox/` were not +touched; no other party's file was edited; no X page was fetched; nothing was deployed. + +— Merlin diff --git a/recoveries/helm-cli-entry-point.md b/recoveries/helm-cli-entry-point.md new file mode 100644 index 0000000..311597d --- /dev/null +++ b/recoveries/helm-cli-entry-point.md @@ -0,0 +1,121 @@ +# Q30 — the renderer's entry point: fixed, gated, and nothing deployed + +*(Merlin, 2026-10-11 ≈09:50–11:20 UTC. Helm lane. All figures measured on this host; +nothing in this record is testimony from another runtime.)* + +## The claim under test + +`python3 /root/.helm/bin/helm-render.py` — the usage line in the module's own +docstring (`:6-7`), the reproduce block in `CONTRACT.md` (`:102`), and the §4 +deploy sentence (`CONTRACT.md:213-214`) — had never executed. The +`if __name__ == "__main__":` guard sat at `:90-91`, above `def build_page` at +`:232`. + +## 1. The defect, reproduced before the fix (measured 2026-10-11 ~09:50Z) + +``` +$ python3 /root/.helm/bin/helm-render.py +Traceback (most recent call last): + File "/root/.helm/bin/helm-render.py", line 91, in + sys.exit(main(sys.argv)) + File "/root/.helm/bin/helm-render.py", line 78, in main + html, report = build_page(now) + ^^^^^^^^^^^^^^^ +NameError: name 'build_page' is not defined +exit=1 + +$ python3 /root/.helm/bin/helm-render.py --out /tmp/helm-cli-probe.html --as-of 2026-10-11T12:00:00Z +…same NameError, same traceback… +exit=1 +$ ls -la /tmp/helm-cli-probe.html +ls: cannot access '/tmp/helm-cli-probe.html': No such file or directory +``` + +Pre-fix file: 18,929 B, sha256 +`00d14453d95234ef49a1d8758ab2de76143e848191331bfec38603e6263403e6`. +Production was never at risk from this failure — it lands before +`out.write_text` — and the live page stayed at `427b7b54…` throughout. + +## 2. The fix (two parts) + +1. **The guard moved to the end of the file** — `:495` of 495 lines, below + `build_page()` (`:273`). `--out` / `--as-of` semantics unchanged. +2. **The destination is gated** (the control plane's 2026-10-11 09:21Z + addendum). `OUT_DEFAULT` is the live document root, so `main()` resolves the + destination and refuses a production write without `--deploy`, returning + **2** with a message naming the path and the flag. `parse_args()` now + returns `(out, now, explicit_out, deploy)`. + +| file | bytes | sha256 (measured 2026-10-11T11:14Z) | +|---|---|---| +| `/root/.helm/bin/helm-render.py` | 21,766 | `5c67473d89283c3d4434928dc96d45ff48a41d8f443ecc3c98e9236be8b597f9` | +| `/root/.helm/bin/helm-selftest.py` | 33,647 | `7ed1bca8f9da624f69b03313506097a0ce9b1130cbad9511908776e5015a0f46` | +| `/root/.helm/CONTRACT.md` | 17,657 | `2c527635ff96eb677e7419ef5b15516811e05cedfa1f072f84dcf67c10214f91` | + +## 3. The CLI transcript, after the fix (exit codes from unpiped runs) + +``` +$ python3 /root/.helm/bin/helm-render.py --out /tmp/helm-cli-evidence.html --as-of 2026-10-11T12:00:00Z +rendered -> /tmp/helm-cli-evidence.html (11806 bytes) +render clock 2026-10-11T12:00:00+00:00 snapshot age 2d 18h 47m +verdict at render: 0 green / 6 not green (5 stale, 1 unreachable) +exit=0 +$ sha256sum /tmp/helm-cli-evidence.html +8b839754b9e33911ec6d74834e4899a8f77f71c361eec98757d6ef08ad891839 /tmp/helm-cli-evidence.html + +$ python3 /root/.helm/bin/helm-render.py +refused: this render would write the live document root (/var/www/alexander-whitestone/helm/index.html) and --deploy was not given. + staged render : --out /path/index.html + deploy : --deploy (an operator's call under §4; nothing here authorises it) +exit=2 + +$ python3 /root/.helm/bin/helm-render.py --out /var/www/alexander-whitestone/helm/index.html --as-of 2026-10-11T12:00:00Z +…same refusal (the destination is matched by resolve(), not string equality)… +exit=2 + +$ python3 /root/.helm/bin/helm-render.py --deploy --out /tmp/helm-cli-evidence2.html --as-of 2026-10-11T12:00:00Z +…renders the staged path… +exit=0 +``` + +`--deploy` alone (which would write production) was **not executed**. It is +exercised inside gate G7 against a patched `OUT_DEFAULT`. + +## 4. Gate G7 — the CLI, executed + +`python3 /root/.helm/bin/helm-selftest.py` → `helm-selftest: 119 passed, 0 +failed`, `VERDICT: ALL GATES PASS`. G7 adds **17** assertions (102 before): + +- exit 0 on a staged render; the file exists; its bytes equal `build_page()`'s + at the same pinned clock; the reported byte count matches the file; `--as-of` + is honoured; the live document root is untouched. +- the default (production) destination is refused (exit ≠ 0), the refusal + names the path and `--deploy`, and nothing is written; an explicit + `--out ` is refused too. +- the `--deploy` branch runs against a patched `OUT_DEFAULT` (a temp path), + never the real one. +- a source-order guard asserts the `__main__` guard sits below `def + build_page`, so the Q30 defect cannot silently return. + +**The gate discriminates**: the exact G7 subprocess command, run against the +pre-fix file, exited 1 with `NameError` (transcript in §1); the same command +now exits 0 and emits 11,806 bytes. + +## 5. Nothing deployed (measured before and after every run in this tick) + +| target | state | +|---|---| +| `/var/www/alexander-whitestone/helm/index.html` | 9,865 B, sha256 `427b7b54c69b18d270288910fc810732463129f48ec4bdd7dbc75cdb22997ce4`, mtime `2026-10-11 08:57:14.017837233Z` (the 08:57:14 write is this lane's earlier byte-exact restore, not a deploy) | +| `/root/.helm/data/snapshot.json` | 14,039 B, sha256 `aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d`, mtime `2026-10-08T17:12:59.475780303Z` | + +The collector was not re-run; no cron job was added; both remain Alexander's +call under §4. + +## 6. Revision note on the deploy sentence (`CONTRACT.md:213-214`) + +The sentence *"Deploying is `python3 /root/.helm/bin/helm-render.py` — one +command"* is true of every revision up to and including `00d14453d952…`. As of +`5c67473d89283c3d…` the bare command is refused with exit 2, and deploying is +`python3 /root/.helm/bin/helm-render.py --deploy` — still Alexander's call +under §4, now an explicit flag rather than the default behaviour of running +the script. The old text was not rewritten; the note is appended.