One of the four checks protecting master was an echo

[gHashTag]

Refs #2754

The gate that checked nothing

t27-master-protection requires four status checks:

check-now-freshness, validate, check, check-linked-issue

and check — the only job in check-now-freshness.yml — was this, in full:

- name: Check freshness
  run: |
    # Add freshness check logic here in future
    echo "Checking repository freshness..."

It passed every pull request it ever ran on. There is no run of it on master at all — the workflow has neither push: nor workflow_dispatch:, so gh run list --branch master returns [].

Branch rulesets are not mine to edit, so the job keeps the name the ruleset requires and is given something real to do. NOW Sync Gate already requires that an entry was added; it never reads it:

NOW Sync Gate	"you wrote one"
this	"what you wrote says something"

tools/check_now_entry_shape.py asserts, per entry the PR adds: the filename is YYYY-MM-DD-<slug>.md; the first line is the NOW heading; the date in the heading matches the date in the filename — a log whose job is chronology cannot have the two disagree; there is a section heading; and at least one bullet that is not a placeholder.

It does not check whether the content is true. No gate can, and pretending otherwise would be this same defect one level up.

Zero entries is a failure here, not a pass. A missing PR_BASE_SHA exits 2 with a message rather than returning a verdict it did not earn.

Six controls run as a step before the check itself — well-formed, heading/filename date mismatch, no bullets, placeholder bullets, wrong first line, empty file. All six behave as stated.

60 files carried one developer's home directory where it was load-bearing

secret-scan rejects /Users/playra/ and finds it in 233 files. Most are prose. Sixty were not:

• 27 seals carried it as spec_path. The seal gate resolves that field, so an absolute path into another machine's home directory can never resolve — the seal describes a spec nothing can fetch. Now repository-relative; all 27 targets verified to exist.
• 33 scripts carried it as their repository root — 26 as the literal ROOT = Path(...), the rest in reads, writes and shell invocations. Each could run for exactly one person. The root now comes from the file's own location.

files carrying the path: 233 -> 173
scripts/ carrying it:     33 -> 0
seals carrying it:        27 -> 0

The comments deliberately do not quote the old literal — a comment naming that path trips the same gate, a mistake this branch made once and corrected.

The remaining 173 are 98 markdown files and 67 Coq build artifacts (.aux/.vo/.glob recording their absolute build path). 208 such artifacts are tracked in this repository, which is a separate question and is left to #2754.

Seal gate exits 0, check_gate_preconditions.py exits 0, suite 2424 passed / 0 failed.

🤖 Generated with Claude Code

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-08-28 16:06:02 UTC

• One of the four checks protecting master was an echo #2756 One of the four checks protecting master was an echo | Created: 2026-08-28 | Updated: 2026-08-28 | 16 failing / 21 total
• Land the formal verification harness on master (it has never run) #2727 Land the formal verification harness on master (it has never run) | Created: 2026-08-27 | Updated: 2026-08-27 | 5 failing / 24 total
• chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.20 #2693 chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.20 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump hyper from 1.10.1 to 1.11.0 #2692 chore(deps)(deps): bump hyper from 1.10.1 to 1.11.0 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 33 total
• chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 #2691 chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 #2690 chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump uuid from 1.23.2 to 1.25.0 #2689 chore(deps)(deps): bump uuid from 1.23.2 to 1.25.0 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total

Summary

Status	Count
Total Open PRs	8
PRs with Failing Checks	7
PRs with All Checks Green	1
READY	0
FAILING	7
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=25a9c40dc273 != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).