Skip to content

Harden coverage honesty, diff GONE gating, and key redaction - #22

Merged
djfksjd merged 1 commit into
mainfrom
harden/coverage-honesty-key-security
Jul 25, 2026
Merged

Harden coverage honesty, diff GONE gating, and key redaction#22
djfksjd merged 1 commit into
mainfrom
harden/coverage-honesty-key-security

Conversation

@djfksjd

@djfksjd djfksjd commented Jul 25, 2026

Copy link
Copy Markdown
Owner

Deep dummy-data testing + Codex adversarial cross-audit surfaced real correctness/coverage/security gaps. All fixed with regression tests (220 passed, 1 skipped) plus offline persona E2E.

What changed

  • Coverage honesty (K-Startup API): duplicate/overlapping pages, id-less rows, or within-page duplicate ids now fail closed to the crawl. Previously a repeated page could reach totalCount by row position and declare proven=True while silently dropping the real tail.
  • Diff GONE gating: an announcement is reported GONE/CLOSED only for a source the current run proved it covered in full (run_manifest status=ok, exit 0). Partial (api-window/page-cap) or manifest-absent sources have removals suppressed — a partial crawl can no longer read as "everything closed". --assume-complete overrides for legacy/manifest-less dirs.
  • Diff correctness: first-time content_hash appearance → CHANGED re-review (was UNCHANGED); profile carryover requires ALL judgment axes; duplicate JSON keys rejected.
  • run_manifest integrity: negative counts and status↔exit_code contradictions rejected; unknown manifest_schema_version preserved as .corrupt rather than silently rewritten; duplicate keys rejected on read.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HNthU8pnPYv2vpEetXdK6P

Deep-test + Codex adversarial audit findings, all with regression tests:

- kstartup_api: fail closed to the crawl on duplicate/overlapping pages,
  id-less rows, or within-page duplicate ids — a repeated page could
  otherwise "prove" exhaustion while dropping the real tail (false
  proven=True). Exhaustion now requires distinct, non-empty ids.
- diff_surveys: GONE/CLOSED is now allowed only for sources the current run
  proved it covered in full (run_manifest status=ok, exit 0). A partial
  (api-window/page-cap) or manifest-absent source has its removals
  suppressed (--assume-complete overrides for legacy dirs) so a partial
  crawl can never read as "all closed".
- diff_surveys: first-time content_hash appearance is CHANGED (re-review),
  not UNCHANGED; profile carryover now requires ALL judgment axes; duplicate
  JSON keys are rejected (object_pairs_hook).
- run_manifest: reject negative counts and status↔exit_code contradictions;
  refuse unknown manifest_schema_version (preserve as .corrupt) instead of a
  silent v1 rewrite; reject duplicate JSON keys on read.

Tests: 220 passed, 1 skipped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HNthU8pnPYv2vpEetXdK6P
@djfksjd
djfksjd merged commit 365caf3 into main Jul 25, 2026
2 checks passed
@djfksjd
djfksjd deleted the harden/coverage-honesty-key-security branch July 25, 2026 09:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant