NA-0686 — infra-literal gate self-test and new needle classes - #43
Merged
Conversation
Carries the spine's updated scripts/ci/infra_literal_scan.py (byte-identical
across all four repositories) and its new self-test.
The gate had no tests. Its refusal to report a pass over an empty input
("NOTHING EXAMINED", exit 2) was correct, valuable and completely unguarded -
which is how a CI gate silently becomes a no-op when a base ref is not
fetched. The self-test pins that refusal, and pins the deliberate asymmetry
that staged mode does NOT refuse, since a deletion-only commit legitimately
has no added lines. It runs BEFORE the scan so a broken instrument fails
before it can report clean.
Two new Tier-2b classes: CGNAT tailnet addresses and the retired public
dynamic-DNS domain, each proven fail-closed on a synthetic added line and
green again on removal. This repository carries 8 dated-record occurrences of
the dynamic-DNS class; Tier-2b added-line semantics leave them untouched and
fail every new one.
The self-test carries no operator literal: every needle is assembled at run
time from fragments that never appear contiguously in its source.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lane: NA-0686. Spine ruling: D-1325.
Carries the spine's updated
scripts/ci/infra_literal_scan.py— byte-identical across all four repositories (md5 verified) — and its new self-test.The gate had no tests
Its refusal to report a pass over an empty input (
NOTHING EXAMINED, exit 2) was correct, valuable, and completely unguarded. That is how a CI gate silently becomes a no-op when a base ref is not fetched: CI goes green and everyone believes it.scripts/ci/infra_literal_scan_selftest.py(13 checks) pins:NOTHING EXAMINEDrefusal intreeanddiffmode;stagedmode does not refuse — a deletion-only or rename-only commit legitimately has no added lines, and blocking those would make the pre-commit hook unusable;It runs before the scan, so a broken instrument fails before it can report clean.
⚠ The self-test carries no operator literal. It runs inside the tree the Tier-1 scan examines, so a test written the obvious way would make the gate fail on its own test file. Every needle is assembled at run time from fragments that never appear contiguously in the source.
Two new Tier-2b classes
CGNAT (
100.64/10) and the retired public dynamic-DNS domain — each proven fail-closed on a synthetic added line and green again on removal.Tier-2b added-line semantics are deliberate here: this repository carries 8 dated-record occurrences of the DDNS class across three test-evidence files, ruled LEAVE because they report what was true when written. The history stays untouched and every new one fails.
Measurements
Spine evidence:
qsl-protocoldocs/governance/evidence/NA-0686_as_built.md.