troupe-standup/CHECK-q161

#!/usr/bin/env bash
# CHECK-q161 -- the jobs-table entry point ran under an interpreter nobody
# invokes, and read a host root as if it were the repository (volt, 2026-11-03).
#
# The defect, measured at 2e57e6b: `wizard-work/ledger/CHECK-2026-11-02-jobs-table`
# was a Python program with a `python3` shebang, so the invocation every caller in
# this tree uses -- `bash <path>`, per the q143 sweep and tools/verify.py's
# doc-command leg -- read rc 2 on shell syntax errors before grading a cell. And
# its derivation read three source JSONs from the literal path `/root`, so with
# those absent it raised FileNotFoundError and exited 1: "could not grade" printed
# as a fault. The grader moved beside it (grade_jobs_table.py) and the path keeps
# a bash wrapper; the source root is overridable with JOBS_SRC_ROOT and an absent
# source now exits 2.
#
# Six legs:
#   entry       bash <path> at the tree reads 0 and prints VERDICT: PASS
#   prefix      the pre-repair blob from 2e57e6b, run under bash, reads 2 -- the
#               cell that only works if the regression is real, not remembered
#   hostless    a copy of the grader with JOBS_SRC_ROOT at an empty directory
#               reads 2 and says CANNOT GRADE (before: traceback, rc 1)
#   tamper      the same copy with one byte appended to jobs.csv reads 1
#   offline     `--offline` at the tree reads 0 and states re-derivation was
#               not attempted, so the weaker reading is never silent
#   sweep       the q143 path census grades this entry point at 0
#
# Exit codes: 0 all legs passed, 1 a fault, 2 could not grade.
set -u
set -o pipefail

cd "$(dirname "${BASH_SOURCE[0]}")" || exit 2
ROOT="$(pwd)"
LEDGER="$ROOT/wizard-work/ledger"
ENTRY="$LEDGER/CHECK-2026-11-02-jobs-table"
GRADER="$LEDGER/grade_jobs_table.py"
SWEEP="$ROOT/wizard-work/volt/q143-check-sweep/check_sweep.py"
PY="${PYTHON:-python3}"
WORK="$(mktemp -d "${TMPDIR:-/tmp}/check-q161.XXXXXX")" || exit 2
trap 'rm -rf "$WORK"' EXIT

for f in "$ENTRY" "$GRADER" "$LEDGER/manifest.json" "$LEDGER/jobs.csv" "$SWEEP"; do
    if [ ! -f "$f" ]; then
        printf 'CANNOT GRADE: missing %s\n' "$f"
        exit 2
    fi
done

# The prefix leg grades a REVISION, so a .git-less export cannot answer it.
# That is rc 2 -- "could not grade" -- not a fault, per the repo's tools/ contract.
if ! git -C "$ROOT" rev-parse --show-toplevel >/dev/null 2>&1; then
    printf 'CANNOT GRADE: %s is not a git work tree\n' "$ROOT"
    exit 2
fi

passed=0
failed=0
row() { printf '  %-11s %s\n' "$1" "$2"; }
verdict() { if [ "$2" -eq 0 ]; then passed=$((passed + 1)); else failed=$((failed + 1)); fi; row "$1" "$3"; }

# --- leg 1: the entry point as every caller invokes it ----------------------
out="$(bash "$ENTRY" 2>&1)"; erc=$?
last="$(printf '%s' "$out" | tail -1)"
verdict entry "$([ "$erc" -eq 0 ] && printf '%s' "$last" | grep -q '^VERDICT: PASS' && echo 0 || echo 1)" \
    "rc=$erc  ${last:-<no output>}"

# --- leg 2: the pre-repair blob, same invocation ----------------------------
git -C "$ROOT" show 2e57e6b:wizard-work/ledger/CHECK-2026-11-02-jobs-table \
    > "$WORK/pre_check" 2>/dev/null || { printf 'CANNOT GRADE: 2e57e6b blob unreadable\n'; exit 2; }
out="$(bash "$WORK/pre_check" 2>&1)"; prc=$?
last="$(printf '%s' "$out" | grep -E 'syntax error|command not found' | tail -1)"
verdict prefix "$([ "$prc" -eq 2 ] && echo 0 || echo 1)" \
    "rc=$prc (want 2)  ${last:-<no shell error line>}"

# --- legs 3 and 4: a copy, graded where the sources are absent --------------
cp "$GRADER" "$LEDGER/manifest.json" "$LEDGER/jobs.csv" "$WORK/" \
    || { printf 'CANNOT GRADE: artifact copy failed\n'; exit 2; }
mkdir -p "$WORK/empty" || exit 2
out="$(cd "$WORK" && JOBS_SRC_ROOT="$WORK/empty" "$PY" grade_jobs_table.py 2>&1)"; hrc=$?
last="$(printf '%s' "$out" | tail -1)"
verdict hostless "$([ "$hrc" -eq 2 ] && printf '%s' "$last" | grep -q '^CANNOT GRADE' && echo 0 || echo 1)" \
    "rc=$hrc (want 2)  ${last:-<no output>}"

printf 'x' >> "$WORK/jobs.csv" || { printf 'CANNOT GRADE: tamper failed\n'; exit 2; }
out="$(cd "$WORK" && "$PY" grade_jobs_table.py --offline 2>&1)"; trc=$?
last="$(printf '%s' "$out" | grep -E '^(VERDICT|  - )' | tail -1)"
verdict tamper "$([ "$trc" -eq 1 ] && echo 0 || echo 1)" \
    "rc=$trc (want 1)  ${last:-<no verdict line>}"

# --- leg 5: the weaker mode must say what it did not measure ----------------
out="$(bash "$ENTRY" --offline 2>&1)"; orc=$?
last="$(printf '%s' "$out" | grep 're_derivation' | tail -1)"
verdict offline "$([ "$orc" -eq 0 ] && printf '%s' "$last" | grep -q 'NOT ATTEMPTED' && echo 0 || echo 1)" \
    "rc=$orc  ${last:-<no re_derivation line>}"

# --- leg 6: the census of entry points grades this path ---------------------
out="$("$PY" "$SWEEP" --repo "$ROOT" --only wizard-work/ledger/CHECK-2026-11-02-jobs-table --check 2>&1)"; src=$?
last="$(printf '%s' "$out" | tail -1)"
verdict sweep "$([ "$src" -eq 0 ] && echo 0 || echo 1)" \
    "rc=$src  $last"

if [ "$failed" -eq 0 ]; then
    echo "q161: $passed leg(s), 0 fault(s), rc 0"
    exit 0
fi
echo "q161: $passed passed, $failed fault(s), rc 1"
exit 1