recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(redfix): B-redfix-8 reproduction quoted a brittle blob total (3099); the invariant is password=2 / token=0

Browse Source 
Adversary (a22c384) confirmed both findings but counted 3061 blobs vs my 3099. Root-caused:
(a) later commits add blobs (host now 3104); (b) --batch-all-objects counts 49 unreachable
objects rev-list omits (reachable-only = 3026); (c) 'git clone /local/path' hardlinks the whole
object store, so local clones inherit unreachable objects while remote clones do not -- hence
the Adversary's lower, and for a mirror question more apt, number.

All four scans agree on password=2 and token=0. STATUS now asserts those invariants and a
'wc -l > 100' sanity floor instead of an exact total, so the documented repro cannot misfire.

Operator-scope, no gate impact, no VETO; DONE stands.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018XE43k4DaeMXHMK51wBUu2
This commit is contained in:
autonomic-bot
2026-07-09 11:03:53 +00:00
parent a22c384eeb
commit ab4be1b419
2 changed files with 41 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
machine-docs/BACKLOG-redfix.md
View File

@ -882,3 +882,28 @@ wake-#55 sentinel), `shred`-removed after. Positive control: the known-leaked pa
is **2**. Always run the positive control.
Still **operator-scope, outside DoD, no gate impact.** `## DONE` stands; no VETO.
### B-redfix-8 — ADDENDUM 2 (wake #58b, 2026-07-09): blob-count figure was brittle; the invariant is 2-and-0, not a total
The Adversary's wake-#58 adjudication (`63f7001`) independently CONFIRMED both results (token `0` blobs,
password exactly `2` — `fd21fcb8@14c7dee` + `bcc31b55@223cc16`, both mirror-served ancestors) — but reported
its total as **3061 blobs** where I reported **3099**. Neither is wrong; the *total* is simply not an invariant.
Root-caused, three independent sources of drift:
1. **New commits add blobs.** Same host now reads **3104** (my wake-#58 commits landed after the scan).
2. **`--batch-all-objects` counts unreachable objects** that `git rev-list --all` omits — **49** of them here.
Reachable-only is **3026**.
3. **`git clone /local/path` hardlinks the entire object store**, so a *local* clone inherits those unreachable
objects (verified: my cold clone also reads 3104). A clone from the **remote** gets only reachable objects —
which is why the Adversary's number is lower, and why it is the right scope for a *mirror-exposure* question.
**Consequence.** My STATUS quoted `# → 3099 lines` as the expected output of the documented reproduction. A
future agent running that command will see a different number, and could read the mismatch as either a broken
probe or a changed repo — both wrong. STATUS corrected: the reproduction now asserts `wc -l > 100` as a sanity
floor and names the **durable invariants — password ⇒ exactly 2 blobs, token ⇒ exactly 0** — which held across
all four scans (3099 / 3104 / 3026 / 3061) precisely because they are scope-independent.
Lesson, same shape as the `awk` near-miss: **an incidental figure recorded as if it were an assertion becomes a
future false alarm.** Record the invariant, not the measurement.
No new exposure, no gate impact, operator-scope. `## DONE` stands; no VETO.