Skip to content

feat(tri): tri gates empty -- what still passes when there is nothing to check - #3016

Merged
gHashTag merged 3 commits into
masterfrom
loop/empty-tree-audit
Sep 3, 2026
Merged

feat(tri): tri gates empty -- what still passes when there is nothing to check#3016
gHashTag merged 3 commits into
masterfrom
loop/empty-tree-audit

Conversation

@gHashTag

@gHashTag gHashTag commented Sep 3, 2026

Copy link
Copy Markdown
Owner

Three readings of one question, and only the third measured the gate

Which gates report success over a tree with nothing in it?

34 of 34 refuse. Every gate copied into an empty directory, run under timeout 25. Clean, plausible, entirely false: timeout does not exist on macOS, so all 34 exited 127 with command not found and the classifier binned every one as a refusal. The tell was the table itself — a classifier that puts 34 of 34 in one bucket is describing its input.

12 of 38 pass. Real runs, by script name. Also wrong: CI does not invoke a script, it invokes a command line. Seven of those twelve are written --require in the workflow, which is exactly the flag that turns their SKIP: t27c is not built branch into a failure.

5 of 36 — the invocations as the workflows write them.

invocations found in .github/workflows   58
run here                                 36
refused the empty tree                   31
PASSED over nothing                       5
  python3 scripts/ci/test_untrusted_javascript_payloads.py
  python3 scripts/ci/test_untrusted_payloads.py
  python3 tools/check_conflict_markers.py
  python3 tools/gft_backprop_microcode.py
  python3 tools/pack_index_consistency_gate.py --selftest

Four are self-contained self-tests, green anywhere by construction. The fifth prints tracked files read 0 before it says the tree is clean — a gate telling a reader it read nothing. This axis is healthy, and after three passes that each found a defect that is worth saying plainly rather than hunting until something breaks.

What shipped

tri gates empty [--verbose] extracts every python3 tools/… / bash scripts/… line the workflows write, verbatim, runs each in a tree holding the scripts and no data, and reports what still exits 0.

Exclusions are printed with the reason, never dropped: a line continued with \, a line inside a $( … ) substitution, and a --self-check run whose subject is the gate rather than the tree. A population that silently shrinks is the defect this command exists to look for. A population of zero is a hard refusal, because it would print as "every gate refuses an empty tree".

It complements tools/check_gate_preconditions.py, which plants the same empty world for 6 of 19 tools/ scripts with hand-written expectations and already names the 13 it does not reach. This measures the whole CI-invoked population behaviourally, scripts/ included, and agrees with an independent shell probe on all five.

The defect in my own probe

The first version copied every file out of tools/ and scripts/, carrying tools/withdrawn.txt and every baseline into the "empty" tree. Not an error — a plausible table with two rows inverted: check_withdrawn_live.py, whose whole job is to refuse when its register is missing, found the register and passed. Caught by running the two by hand and disagreeing with my own command.

An empty tree that carries the data is not an empty tree. The repair is an extension filter, and its test plants gate.py, helper.sh, withdrawn.txt, baseline.json and demands exactly the two scripts arrive.

Controls

check result
cargo test -p tri 462 passed, 0 failed
independent shell probe vs this command agree on 5 of 36, same five
mutation: drop the arguments from the invocation red (2 of 4)
mutation: treat a continued line as runnable red
mutation: treat --self-check as runnable red
mutation: copy every file into the scratch tree red
mutation: any python3 … counts as a gate red

Skill §441–442.

Refs #2994

🤖 Generated with Claude Code

gHashTag and others added 2 commits September 3, 2026 17:39
… to check

Runs every gate invocation the workflows write, verbatim, against a tree
that holds the scripts and no data. Of 36 runnable invocations, 31 refuse
and 5 pass; four of the five are self-contained self-tests and the fifth
prints "tracked files read 0". This axis is healthy and the number is
worth having written down.

The population is the COMMAND LINE, not the script. By script name the
same probe reads 12 of 38 -- seven of those twelve are invoked with
--require, which is exactly the flag that turns a SKIP branch into a
failure. A gate is what it is called with.

Exclusions are printed with their reason: a line continued with a
backslash, a line inside a command substitution, and a --self-check run
whose subject is the gate rather than the tree. A population that
silently shrinks is the defect this command exists to look for.

Complements tools/check_gate_preconditions.py, which covers 6 of 19
tools/ scripts with hand-written expectations and says so; this measures
the whole CI-invoked population behaviourally, scripts/ included.

Refs #2994

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… tree that was not empty

441: 34 of 34 refuse (every one was 'timeout: command not found' on
macOS), then 12 of 38 pass (measured by script name, where CI writes
--require), then 5 of 36 (the invocations as written). A gate is what it
is called with, and a clean audit is a result.

442: the probe's own scratch tree carried tools/withdrawn.txt and every
baseline, so two gates read backwards. Caught by running them by hand and
disagreeing with my own command.

Refs #2994

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-09-03 10:40:48 UTC

Summary

Status Count
Total Open PRs 12
PRs with Failing Checks 10
PRs with All Checks Green 2
READY 1
FAILING 10
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=1b52250fc530 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

…4-445)

The parallel session landed 441-443 while this branch was open.

Refs #2994
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-09-03 10:53:32 UTC

Summary

Status Count
Total Open PRs 11
PRs with Failing Checks 10
PRs with All Checks Green 1
READY 0
FAILING 10
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=2a95b1f73357 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@gHashTag
gHashTag merged commit ab11340 into master Sep 3, 2026
36 checks passed
@gHashTag
gHashTag deleted the loop/empty-tree-audit branch September 3, 2026 11:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant