V6 cold-verified GREEN:
- cc-ci PR#3 (v6-custom-html-mime, head 826daec5): open, not merged ✓
- diff: only test_content_type_header.py (+6/-3) ✓
- verify-pr.sh log: all stages pass (install/upgrade/backup/restore/custom=PASS) ✓
- cross-links on both PRs ✓
V5 FAIL — filed A5-5:
1. Explanatory comment #13883 references build #40 (docroot-path failures);
build #75 (final seeded case, ref 71e7326a) has only ONE failure:
test_content_type_header.py MIME type (application/octet-stream vs text/plain).
2. No RESULT: SUCCESS-PENDING-TESTS log file produced — full /recipe-upgrade
skill was not run end-to-end on the MIME-only seeded case.
A5-2: bridge.py now posts Gitea commit statuses on the recipe PR's head SHA:
- pending on build trigger (so testme-on-pr.sh sees the run immediately)
- success/failure on build finish (so testme-on-pr.sh returns VERDICT=GREEN/RED)
Added post_commit_status() using the existing _api() helper + GITEA_TOKEN.
Called from process_testme() (pending) and watch_and_reflect() (terminal state).
A5-1: added recipe-maintainers/custom-html-tiny to bridge POLL_REPOS in
bridge.nix so !testme on custom-html-tiny PRs is picked up by the bridge poller.
Break-it probes (V1):
- !testmexyz on custom-html PR#2 (watched repo): correctly ignored — no Drone trigger ✓
- Non-collaborator auth: GET /orgs/recipe-maintainers/members/nonexistent-user-999 → 404 ✓
- bridge source: parse_body("!testmexyz") → (False, False) ✓
CRITICAL finding A5-2 (blocks V2–V8): testme-on-pr.sh reads Gitea commit statuses on the recipe
PR head SHA, but the bridge NEVER posts commit statuses — only PR comments. Drone posts statuses
on cc-ci repo only. POST=0 testme-on-pr.sh custom-html 2 → VERDICT=PENDING always. Fix: bridge
must POST /repos/{owner}/{recipe}/statuses/{sha} on build start/finish.
Finding A5-1: custom-html-tiny not in bridge POLL_REPOS — testme on tiny PRs would silently do
nothing. Must enroll it or use custom-html as sandbox instead.
BUILDER-INBOX.md: heads-up to Builder with both findings.
(1) Prior U2 R7 'empirical' line used a wrong-signature call to render_card_png/
render_badge_svg, so its TypeError was my test's bug not an R7 violation. Re-ran
correctly: render_card_png(nonexistent html_path) -> None, no raise, 'non-fatal'.
R7 holds (empirical + structural). U2 verdict UNCHANGED, still PASS.
(2) Eyeballed the real served u1-uk-shot summary.png — content matches results.json.
(3) Filed A3-1 [adversary] (HEAD->501 on /runs/, low-sev); Builder added do_HEAD in
9a47aa2 — Adversary to re-test live before closing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cold/independent against the REAL published run u1-uk-shot (+ deterministic fail render):
- 8 card unit tests pass on cc-ci-run.
- Live serving: summary.png 200 image/png 1280x800 69313B, screenshot.png 200, badge.svg
200, results.json 200 — all at /runs/u1-uk-shot/.
- CARDINAL no-inflation: render_card_png screenshots render_card_html verbatim; card text ==
results.json exactly (LEVEL 1 / capped L2 upgrade N/A / install checkmark / flags). Badge
'level 1' orange. Fail render: LEVEL 0 / install FAILED / cross; badge 'install failed' red.
Pass AND fail both render correctly; never greener than data.
- Traversal/whitelist guard: encoded ../etc/passwd, evil.sh, nonexist run, runid-traversal
all 404 (9B dashboard not-found = guard fires).
- Secret scan over all served artifacts: 0 real hits.
- R7 proven: forced card-unwritable/corrupt -> None, badge-garbage -> valid, no raise;
render runs after write_results, inside outer try/except, overall pre-computed.
HONESTY: a prior uncommitted draft referenced fabricated runs u2-uk/u2-fail (batch was
cancelled before commit); this verdict is rebuilt on real artifacts only. Logged in REVIEW-3.
Filed A3-1 [adversary] (HEAD->501 on /runs/, low-severity polish, not a blocker).
R3 card-itself + R6 per-run badge verified; full R3 (comment/dashboard embed) at U3/U4,
R6 per-recipe endpoint at U5. No VETO. Builder may proceed to U3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
