Skip to content

fix: case registry locking, watchdog proof verification, viewer matching, export paths - #121

Draft
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-correctness-issues-daa2
Draft

fix: case registry locking, watchdog proof verification, viewer matching, export paths#121
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-correctness-issues-daa2

Conversation

@cursor

@cursor cursor Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Summary

Nightly critical-correctness scan found four high-severity bugs in recently merged code that escaped review. This PR applies minimal, targeted fixes with regression tests.

Bugs fixed

1. litigation/run.py — duplicate Case Nos / registry corruption

Impact: Concurrent transcript saves could assign duplicate Case Nos or corrupt case-registry.yaml. When the registry file was missing, every save returned YYYY-DEL-001 without persisting, causing permanent duplicate numbering.

Root cause: Unlocked read-modify-write on the registry; early return on missing file without creating/persisting.

Fix: Exclusive fcntl file lock, create registry on first use, year rollover reset, fsync after write.

2. executive/watchdog.py — override approval bypass

Impact: Any executive action whose action_type contained the substring "override" skipped judicial approval checks entirely, even with missing or forged proof.

Root cause: Inverted guard — presence of "override" in action type exempted the action from verification.

Fix: Require OverrideProof.verify() for override actions; alert on missing/invalid proof.

3. litigation/viewer.py — wrong transcript served

Impact: Substring matching (name in stem) could return the wrong transcript when names shared a common substring (e.g. query dispute matching border-dispute and trade-dispute).

Fix: Exact/prefix/suffix matching via _resolve_transcript().

4. courtroom/portal/export_transcript.py — double-prefix path 404

Impact: Passing courtroom/transcripts/foo.md resolved to nonexistent courtroom/courtroom/transcripts/foo.md, breaking portal export.

Fix: resolve_transcript_path() strips redundant courtroom/ prefix.

Validation

  • python3 -m pytest tests/ -q69 passed
Open in Web View Automation 

…ing, export paths

- allocate_case_no: create registry when missing, exclusive fcntl lock, fsync,
  and year rollover reset to prevent duplicate Case Nos under concurrent saves
- watchdog: require OverrideProof.verify() for override actions instead of
  skipping checks when action_type contains override or proof is non-empty
- litigation viewer: resolve transcripts by exact/prefix/suffix rules, not
  arbitrary substring match (bar must not match foo-bar)
- export_transcript: resolve_transcript_path strips courtroom/ prefix so
  repo-root paths do not double-prefix to courtroom/courtroom/transcripts

Co-authored-by: Jack J Burleson // LJM <Exios66@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant