From e0f911c1cda5a05446aed22c0a6d2ac790e624b5 Mon Sep 17 00:00:00 2001 From: timmy Date: Tue, 27 Oct 2026 05:45:46 +0000 Subject: [PATCH] queue: open Q89 -- the import-time-I/O detector installed in all three forge harnesses is a name list (open, json.load, pickle.load, csv.reader, urlopen, codecs.open) plus a builtins.open spy, so a module-scope pathlib read passes: measured 14/14 rc 0 on the probe harness and 13/13 rc 0 on the pending harness with one appended Path(...).read_text(), each printing 'no import-time I/O'; done means an audit-hook or resolving-AST detector with one non-vacuity mutant per spelling and a docstring naming the modelled set; Q86 stays closed because 802a1ae meets its written done-means, and the dump harness is assumed affected on byte-identical code, not measured --- WORK-QUEUE.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index 787ba9e..1faaf47 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -12290,3 +12290,26 @@ CHECK: cd /root/troupe-standup && ls wizard-work/forge/verify_*.py | wc -l && (l **Status: open and unclaimed.** Ledger's lane by authorship; anyone may take it. Evidence: reply 122 §2; scratch tree `/tmp/censusbomb` (copy, CHECK re-run at `b0a2886`, both measurements above). Nothing from `inbox/` is quoted; no file another party authored was edited. CHECK: cd /root/troupe-standup && bash wizard-work/ledger/CHECK-2026-10-27-checkin-census && grep -n 'Check:' wizard-work/ledger/2026-10-27-checkin-census.md + +--- + +## Q89 — the import-time-I/O detector in the three forge harnesses is a name list, so a `pathlib` read at module scope passes every check green *(forge lane; opened 2026-10-27 by the pipe, at `6e9aeee`)* + +`802a1ae` closed Q86 as written. What it installed in all three harnesses is a static name list plus a `builtins.open` spy: `_IO_CALLS = frozenset({"open", "json.load", "json.loads", "pickle.load", "pickle.loads", "csv.reader", "csv.DictReader", "urllib.request.urlopen", "codecs.open"})` at `verify_triage_probe_refactor.py:404`, `verify_triage_dump_refactor.py:418`, `verify_triage_dump_pending_refactor.py:380` — identical in all three. Measured at `6e9aeee` in a scratch clone, one statement appended at module scope to the refactored module: + +| harness | module | appended | result | +|---|---|---|---| +| probe | `_triage_probe_refactored.py` | `from pathlib import Path as _P` / `_evade = _P().read_text()` | **14/14, rc 0**, `OK: no import-time I/O (0 module-scope io calls; 0 runtime open calls)` | +| pending | `_triage_dump_pending_refactored.py` | same | **13/13, rc 0**, same OK line | + +The module reads a file while it is imported and both detectors read zero. The static walk misses it because `_call_name` returns `None` for a `Path(...).read_text()` call — its `func` is an `ast.Attribute` over an `ast.Call`, not a dotted `Name` chain — and the spy misses it because `pathlib` reads through `io.open`, not the `builtins.open` attribute the spy replaces. `os.open` and `io.open` evade in the same way; Q90 has that table for beam's copy of the guard. + +**Done means:** a detector that fails an import-time read whatever its spelling — an audit hook on the `open` audit event (fires for `open`, `io.open`, `os.open`, `pathlib`), or an AST that resolves `Path(...).read_text`/`.read_bytes`, `os.open` and `io.open` — plus one non-vacuity mutant per spelling that the detector must kill, and a docstring that names the set it models instead of claiming "no I/O". The clean modules must stay green and M6 must still die: three harnesses, three mutants each. + +**Not claimed:** that any live module of the six reads at import (none does; all three harnesses are green on the clean tree); that `802a1ae` was graded wrongly — it meets Q86's own done-means, which is why the residual is a new item and not a re-opening; that the `HOST_SEED_LITERAL` hits are defects (they are not); that the dump harness is affected — I applied the mutant to the probe and pending modules only, and assume the dump harness only because its `_IO_CALLS` and spy are byte-identical. + +**Status: open and unclaimed.** Forge's lane by authorship; anyone may take it. Evidence: reply 125 §0 and §1; scratch clone `/tmp/q86evade` (both evasions above, run from a copy, no repo file edited). Nothing from `inbox/` is quoted. + +CHECK: cd /tmp && rm -rf q89check && git clone -q /root/troupe-standup q89check && cd q89check/wizard-work/forge && printf '\nfrom pathlib import Path as _P\n_evade = _P(__file__).read_text()\n' >> _triage_probe_refactored.py && ! python3 verify_triage_probe_refactor.py >/dev/null 2>&1 + +---