Plan 00067: QA gates scanned ZERO files in a nested checkout and reported a pass

`./scripts/qa-all.bash` — the gate CLAUDE.md makes mandatory before every
Bash/Python commit — printed `✓ bash: 0 files OK` while checking nothing, in
any checkout living under a path segment it excludes. lts-infra vendors this
repo at untracked/repos/fedora-desktop, so that is not hypothetical.

Cause: the exclusions are repo-root-relative in intent (`untracked/`,
`roles/vendor/`, `.claude/ccy/`, …) but were written as unanchored globs.
`find -path` matches the WHOLE path it prints, so `! -path "*/untracked/*"`
excluded the entire repository. 112 bash files, all JS, and — masked behind
`ruff not installed` — all Python went unscanned, exit 0 throughout. A control
silently degraded to a no-op: the same outcome the ban on `|| true` exists to
prevent, reached without using any banned token.

Fix, in two halves:

- Anchor every root-relative exclusion to `$REPO_ROOT`. `.git`, `node_modules`,
  `__pycache__`, `.venv` and `venv` stay unanchored — they legitimately occur at
  any depth. This stops today's instance.
- Add a zero-file guard to each gate: finding no files of its language exits 2
  with the likely cause named, instead of reporting a pass. This stops the class
  — the next mis-scoped exclusion, wrong REPO_ROOT, or rename.

Proven by measurement in the affected checkout, not by reasoning about the patch:

  qa-bash    exit 0, 0 files  ->  exit 0, 112 files  (105 shellcheck findings, 0 error-level)
  qa-js      exit 0, 0 files  ->  exit 0, 6 files
  qa-python  exit 2 (masked)  ->  exit 0, 38 files   (discovery proof, stub analyser)

The 105 shellcheck findings are warning/info/style on files never analysed here
before — results, not regressions. They must not be re-hidden.

Two things stated rather than smoothed over:

- The plan predicted 86 bash files. The real number is 112: the first estimate
  counted only name-matched *.sh/*.bash and missed the second find block, which
  picks up shebang'd executables and was equally disabled. The defect was bigger
  than the plan said. Corrected in the doc rather than left as an overshoot.
- `qa-python.bash` checks for ruff BEFORE discovery, so neither its anchoring fix
  nor its guard is reachable while ruff is absent. Both were proven with a stub
  ruff that lints nothing; the 38 files did pass a real py_compile, but the stub's
  empty result set is not evidence of clean Python.

Also recorded in CLAUDE/QA.md: a `0 files` report is a failure; never remove the
guard to make a gate work somewhere. Plus a follow-up finding of the same class,
deliberately NOT fixed here — qa-bash treats shellcheck as optional while
qa-python treats ruff as required, so a box without shellcheck gets a green
qa-all with no static analysis of its bash at all. That is an IaC question about
declared dependencies with a far wider blast radius than a path-matching bug.

The `ruff not installed` exit 2 is NOT this repo's gap, contrary to the plan's
original Non-Goal: ruff is declared in both play-python.yml and this repo's own
.claude/ccy/Dockerfile. The gate was run from lts-infra's container, which
installs only ansible-lint and yamllint. Corrected in the plan; the fix belongs
in lts-infra's IaC.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: LTSCommerce

CLAUDE/Plan/Completed/00067-qa-gates-inert-in-nested-checkout/JOURNAL/00067-Journal-26-07-29.md

@@ -0,0 +1,181 @@
+# Plan 00067 — Journal 26-07-29
+
+> **Append-only activity log** for plan 00067. One file per day
+> (`00067-Journal-YY-MM-DD.md`). `PLAN.md` tracks the plan (what/why,
+> current state, tasks); this journal tracks what actually *happened* —
+> findings, decisions, dead-ends, hand-off state — the linear lifecycle a plan
+> document structurally cannot carry.
+>
+> **Entry grammar** — append new entries at the BOTTOM; NEVER edit earlier
+> entries (corrections are new entries):
+>
+> ```
+> ## HH:MM · category · REF   — optional short title
+> ```
+>
+> - `HH:MM` local 24h (the date is in the filename); times increase down the file.
+> - `category` ∈ `action` | `finding` | `decision` | `thought` | `blocker` | `handoff`
+> - `REF` = optional task/phase ref (`T1.2`, `P1`) or `—`.
+> - Bodies may embed fenced logs/diffs/snippets — no size limit — with a
+>   one-line takeaway above the fence.
+> - End a working session with a `handoff` entry so the next agent's entry
+>   point is the last entry of the newest day-file.
+
+## 22:08 · action · — — plan scaffolded
+
+Plan 00067 created via `mkplan.bash`; `JOURNAL/` initialised. Next:
+fill in `PLAN.md`, then log progress here as it happens.
+
+## 22:12 · action · T1.2,T1.3 — anchoring + zero-file guards applied
+
+Anchored every repo-root-relative `find -path` exclusion to `"$REPO_ROOT"` in
+`scripts/qa-bash.bash` (both find blocks), `scripts/qa-python.bash` (both) and
+`scripts/qa-js.bash` (one). Left `*/.git/*`, `*/node_modules/*`,
+`*/__pycache__/*`, `*/.venv/*`, `*/venv/*` unanchored — those legitimately occur
+at any depth. Added a zero-file guard to each gate (exit 2, message naming the
+likely cause).
+
+`bash -n` clean on all three; `shellcheck -x` exit 0, no new findings.
+
+## 22:15 · finding · T2.1 — the predicted count was WRONG, and low
+
+`PLAN.md` predicted bash would go 0 → 86. Measured after the fix: **112**.
+
+The 86 came from my Task 1.1 measurement, which counted only the `*.sh`/`*.bash`
+**name-matched** files. `qa-bash.bash` has a *second* `find` block that picks up
+executables carrying a bash shebang with no such extension — and that block was
+disabled by the identical unanchored glob. So the defect was bigger than the plan
+said, not smaller, and the success criterion "scans 86 files" was itself wrong.
+
+Corrected the Overview, Task 1.1 and the success criterion to 112 with the
+reason, rather than leaving 112 looking like an unexplained overshoot.
+
+```
+=== AFTER, same nested checkout ===
+qa-bash     exit=0   ⚠ shellcheck: 105 issues   ✓ bash: 112 files OK
+qa-js       exit=0                              ✓ js: 6 files OK
+qa-python   exit=2   ✗ python: ruff not installed (sudo dnf install ruff)
+```
+
+The 105 shellcheck findings are all `warning`/`info`/`style` — 0 `error`-level, so
+exit 0 is correct. They are **results, not regressions**: files that had never
+been analysed here. Triage is separate work; they must not be re-hidden.
+
+## 22:18 · finding · T2.1 — qa-python's own fix is unreachable in this container
+
+`qa-python.bash` checks for `ruff` at line 22, **before** file discovery. With
+ruff absent it exits 2 there, so neither its anchoring fix nor its new zero-file
+guard is reached — the gate would report the same thing either way. Running it and
+seeing `exit 2` proves nothing about the fix.
+
+Proved both with a **stub `ruff`** on `PATH` that lints nothing and prints `[]`:
+discovery went 0 → 38 and the guard fired `exit 2` on an empty tree. Stated
+explicitly in `PLAN.md` that the 38 files did pass a *real* `python3 -m py_compile`
+and that the stub's empty result set is **not** evidence of clean Python — that
+distinction is the entire subject of this plan, so blurring it here would be
+self-defeating.
+
+Not fixing `ruff not installed`: it is a real IaC gap, `exit 2` is the correct
+fail-fast behaviour, and it is an explicit Non-Goal.
+
+## 22:20 · action · T2.2 — negative control on the exclusions
+
+Confirmed 0 of 112 scanned files come from an excluded tree — and, more usefully,
+that the exclusions are not *vacuously* satisfied. Each excluded tree genuinely
+contains bash that is genuinely being skipped:
+
+```
+untracked                   7 bash files present, 0 in scanned set
+roles/vendor               23 bash files present, 0 in scanned set
+.claude/hooks-daemon       88 bash files present, 0 in scanned set
+.claude/ccy                20 bash files present, 0 in scanned set
+.claude/skills              6 bash files present, 0 in scanned set
+.ansible/roles             23 bash files present, 0 in scanned set
+```
+
+167 files skipped on purpose, 112 scanned. Asserting only "no excluded path
+appears" would have passed just as happily if the trees were empty.
+
+## 22:22 · action · T2.3 — the guard fires
+
+Copied each gate into an empty tree **without** a `.sh`/`.bash`/`.js` name and
+**without** the execute bit. That detail is load-bearing: a copy named
+`qa-bash.bash` is itself discovered, the gate reports `1 file OK`, and the test
+silently proves nothing. All three exit **2** with the diagnostic.
+
+## 22:26 · finding · — — same class, found in our own docs, deliberately NOT fixed
+
+While writing the `CLAUDE/QA.md` note I hit this in the existing gate table:
+
+> `qa-bash.bash` … shellcheck (only when `shellcheck` is in PATH — silently
+> skipped if absent)
+
+That is the same defect this plan is about: `qa-bash` treats its analyser as
+optional (absent ⇒ writes `[]`, still reports a pass) while `qa-python` treats
+its analyser as required (absent ⇒ exit 2). On a box without `shellcheck`,
+`qa-all.bash` goes green with **no static analysis of its bash at all**. The
+zero-file guard does not catch it — the file count is non-zero; it is the
+*analysis* that is missing.
+
+Left unfixed on purpose, and said so out loud in both `PLAN.md` and `QA.md`
+rather than quietly folding it in: making `shellcheck` required is an IaC
+question about the gate's declared dependencies with a far wider blast radius
+than a path-matching bug, and it belongs with the `ruff` gap in its own plan.
+Recorded so it is tracked, not stranded in a session transcript.
+
+## 22:28 · action · T3.1,P3 — recorded and completed
+
+`CLAUDE/QA.md` gained a "A gate reporting `0 files` is a FAILURE, not a pass"
+section (the instance, the anchoring rule, "never remove the guard to make a gate
+work somewhere", and the shellcheck caveat above). Folder moved to `Completed/`,
+status flipped to Complete, README index row added in the same commit.
+
+## 22:30 · handoff · — — 00067 closed; 00066 still needs the HOST
+
+Plan 00067 is Complete: all tasks ✅, all success criteria met, proven by
+measurement in the affected checkout rather than by reasoning about the patch.
+
+Still open elsewhere, unchanged by this plan:
+
+- **Plan 00066 needs a HOST run** of
+  `CLAUDE/Plan/00066-ccy-ci-runner-variant/triage.bash`. `plan_require_host`
+  correctly refuses to run it in this container, so those facts cannot be
+  self-served. E6 is already settled (`EXIT 125` — a missing `--device` is fatal
+  to podman).
+- `ruff` is not installed here (IaC gap), and the `shellcheck`-optional finding
+  above wants its own plan.
+- 105 shellcheck `warning`/`info`/`style` findings are now *visible* on 112 files
+  that were never analysed before. Nothing regressed; they were always there.
+
+## 22:34 · finding · — — CORRECTION: the `ruff` gap is not this repo's
+
+Two corrections to entries above (appended, per the append-only rule — the
+originals are left as written).
+
+**1. I edited an earlier entry in this file and had to undo it.** Reaching for
+`Edit` on the 22:30 handoff to point it at this correction was exactly the thing
+the rule forbids. Reverted byte-identical; the correction is here instead. Noting
+it because it is the second time this session I have walked into an append-only
+trap I already knew about.
+
+**2. The `ruff not installed` gap is NOT fedora-desktop's.** The 22:18 entry and
+the plan's Non-Goal both called it "a real IaC gap" in this repo. It is not. This
+repo declares `ruff` in both places it needs it:
+
+```
+playbooks/imports/play-python.yml:20      - ruff          # host, via dnf
+.claude/ccy/Dockerfile:33                 pipx install ruff   # its own CCY image
+```
+
+I am running in **lts-infra's** CCY container, not fedora-desktop's — lts-infra
+vendors this repo at `untracked/repos/fedora-desktop`, and its
+`.claude/ccy/Dockerfile` installs only `ansible-lint` and `yamllint`. So the
+missing dependency belongs to the surrounding container image, and the IaC fix
+belongs in lts-infra, not here.
+
+This is the same shape of mistake as the one this whole plan is about: a true
+observation (`ruff` is absent, exit 2) attached to the wrong subject (*this repo's*
+IaC). Had I "fixed" it here I would have added a duplicate declaration to a repo
+that already had one, and left the actual gap in place. Corrected in `PLAN.md`'s
+Non-Goals too, since a stale Non-Goal would send the next reader hunting for a gap
+that does not exist.