test(quality): the username-as-access-key screen could be narrowed to silence (BACKLOG #1226) - #595
Merged
Merged
Conversation
… silence (BACKLOG #1226)
The screen and its wiring already shipped. What was missing is the row's PROOF CLAUSE: nothing
stopped the report being emptied by a one-line edit that looks like reclassifying a field.
MEASURED, NOT READ. The dispatch said limb 2's absence rested on reading the test module plus two
history searches, with no executed mutation. So I ran one. Moving "uploader" from ACCESS_KEY_NAMES
into LABEL_NAMES:
the suite 10 passed -> 10 passed, unchanged
the live report 8 candidates -> 7; excluded 80 -> 81
api/app.py save(uploader=...) DISAPPEARS from the report entirely
The uploads site stops being surfaced for judgement and is silently recorded as "excluded as
correct". Nothing reds. Being absent from a report is indistinguishable from having been adjudicated
correct, which is the whole defect.
*** A DISJOINTNESS TEST DOES NOT CATCH IT, and that is the trap. *** The mutation REMOVES the name
from one set and ADDS it to the other, so the two stay disjoint throughout. Membership has to be
PINNED -- the device tests/test_private_paths_stay_ignored.py already uses.
THREE TESTS, TWO ROUTES, AND THEY DISCRIMINATE RATHER THAN OVERLAPPING. Each set-level guard fires
on its own route only, which is what shows they are two tests and not one wearing two names:
mutation pin overlap proof clause
move uploader (remove + add) FIRES silent FIRES
add uploader to LABEL_NAMES only silent FIRES FIRES
Both scored by applying the mutation, running, and restoring from a byte copy, hash-verified
identical each time.
THE PROOF CLAUSE IS ASSERTED ON THE SHIPPED SCREEN'S OUTPUT, not on its constants, and that is
deliberate: the two set-level tests each cover one narrowing route, while the report assertion
covers the OUTCOME regardless of route -- a rule change or a scope change would red it too.
IT DOES NOT CALL THE SITE A DEFECT, which the row is explicit about. `uploader=identity.username`
may well be correct code -- a sibling `uploader_id` can carry the key. The screen emits CANDIDATES,
never verdicts, and several reported sites are correct. What is asserted is that a reader still gets
to SEE it and decide. That constraint pulls against the other one -- the report must stay reviewable
AND must not become a verdict -- and dropping either gives the wrong artifact.
I DID NOT REBUILD THE SCREEN. The dispatch warned that a builder reading only the row's opening
would, and it is already on main and already wired into ci.yml and pre-commit. My own screen
confirmed it: 5 BACKLOG-form commits postdating the 2026-08-11 filing.
VERIFIED, scope named:
pytest 13 passed, tests/test_username_access_key_screen.py (10 -> 13)
ruff format --check, ruff check, mypy -- run separately, each with its own exit code, all clean.
mypy flagged my own helper for a missing return annotation and I fixed it rather than leaving a
known error on the grounds that CI does not cover tests/.
the shipped screen run directly, before and after each mutation
NOT a full-suite run
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
wshallwshall
enabled auto-merge (squash)
August 25, 2026 20:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The screen and its wiring already shipped; what was missing is a proof clause -- nothing stopped
the report being emptied by a one-line edit that looks like reclassifying a field.
Measured, not read: moving `uploader` from `ACCESS_KEY_NAMES` into `LABEL_NAMES` leaves the
suite green (10 passed, unchanged) while the live report drops from 8 candidates to 7. The uploads
site stops being surfaced for judgement and reads as silently "excluded as correct" -- nothing
reds. A disjointness test doesn't catch this: the mutation removes the name from one set and adds
it to the other, so the two sets stay disjoint throughout. Membership has to be pinned.
Three tests, two routes, that discriminate rather than overlap (each fires on its own mutation
route only, confirmed by scoring both routes against both tests) -- plus a proof-clause assertion
on the shipped screen's output, not its constants, so a rule change or scope change would also
red it. Doesn't call `uploader=identity.username` a defect -- the screen emits candidates, never
verdicts; what's asserted is that a reader still gets to see the site and decide.
Rebased onto current main (was 22 commits behind) and re-verified after rebase: 13/13 in
tests/test_username_access_key_screen.py.
Co-Authored-By: Claude Opus 5 noreply@anthropic.com