[prodelt]

Summary

Follow-up to #3, which merged spec 024's T001–T007, T009 and T010. This carries the rest: T008 closes the spec, D28's root is finally closed, and — most importantly — the regressions that spec 024 itself introduced, found by the /code-review requested on #3 and reproduced end-to-end.

They are recorded in docs/DEFECTS.md alongside everyone else's, because "the suite is green" and "the slice is correct" are different claims, and the suite covered none of them.

T008 (D36) — the config is a contract

Eight of the thirty-three fields the code reads were validated. The rest did not reject a typo, they changed how the gate behaves:

validateHarnessConfig({ shel: 'bash', oracelSelect: 'impact', batch: 'three',
                        specApproval: 'no', redProof: 'OFF' })   // → { ok: true }

specApproval: "no" is a non-empty string, so the approval gate stayed on. redProof: "OFF" is not 'off', so the circuit stayed on. batch: "three" became 3. Now every field is typed, including nested background.* and l0.*, with a separate dictionary of retired fields (judge.verify, fleet, workers) so they are named as retired rather than reported as typos. Types are errors; unknown keys are warnings until the next minor (SCHEMA_VERSION), because retired fields sit in existing configs. All 33 fields are now documented in docs/USAGE.md — none were before.

The schema was written from the code rather than from assumption, and that paid off immediately: its first version rejected working configs on branchPolicy, where an invented current disagreed with the real feature | none.

D28's root

"Version declared in six places, version-check checks four" was recorded with the root cause "fix it with one source for the list of places, not another check beside it." The sixth place — skills/elt/SKILL.md frontmatter — was checked by the doctor but not by version-check, and docs/RELEASING.md was written to version-check's coverage. So bumping the version strictly by the instructions passed as ok and produced four red files in the full oracle. The place was added to collectVersions() — that single list — and RELEASING.md now points at it instead of restating it.

The regressions spec 024 introduced

All three of the first group share one root, and it is the same root as the original defect: do not hash a format you do not control.

• R1 — treeHash went blind under diff.noprefix. The diff header was parsed with a regex requiring literal a/…b/. With diff.noprefix or diff.mnemonicPrefix in someone's .gitconfig, no block matched and the entire diff dropped out of the hash — while the gate printed "дерево сверено" and exited 0. Reproduced: proof taken, tracked file rewritten in full, gate accepted. The pre-024 code failed open here and caught the edit, so this was a regression of exactly the property the proof exists for.
• R2 — renames still shifted the hash across staging. Before git add -A a move is D old + ?? new; after, it is one R old -> new row plus a rename block in the diff. A slice containing a file move could not be committed under the managed hook — the very defect class T003 declared closed, simply never tested on a rename.
• R3b — a non-ASCII filename's content never entered the hash. Found by adversarially re-reading my own fix. core.quotepath is on by default, so such a path arrives C-quoted ("\320\234…"); reading the file from disk then failed and was swallowed by the adjacent catch. The path made it into the hash, the contents did not — so editing such a file after the proof stayed invisible to the gate. Same class as D21. The regression is discriminating: verified red with the flag removed.

Git's output is now forced canonical in one place: -c core.quotepath=false -c diff.noprefix=false -c diff.mnemonicPrefix=false --no-renames --no-ext-diff.

• R3 — the ran === 0 rule was simply wrong. A warm cache produces exactly ran: 0, cached: N, total: N; measured on this repo, a second oracle run prints "118 попаданий, 0 к прогону". So the second elt commit in a row died with exit 4, and the only escape was --full, which the message never mentioned. From the proof alone a warm cache and a forged one are indistinguishable in principle, so the heuristic could never have worked. It is removed; the real protection against E17 is the cache's move into .git/elt/ plus elt gate --ci now running with --full always rather than on a flag — the CI backstop does not trust the cache.
• R4–R6. review (read by judge-core.js:reviewConfigOf) was missing from the schema, so a project using it got "неизвестное поле" on every command — the same read/schema drift the schema was written to forbid. elt-verify-bg and project-bootstrap silently substituted a default for an unknown shell while the foreground refuses it, so the background would judge a config the foreground rejects. And elt init wrote shell: "bash" into every new project, re-pinning the field T001 had just removed from the shipped config — on Windows that config dies immediately.

D42 — inherited, not ours, and it needs your decision

The benchmark's preregistration lock (verifyRunnerHash) has been broken since e03105b (spec 021), where runner.js was edited without recomputing preregistration.json.runner.sha256. Bisection is in docs/DEFECTS.md:

OK        00138e0  actual=a65f583b7106  expected=a65f583b7106
MISMATCH  e03105b  actual=925bb5cfb4b8  expected=a65f583b7106   ← broke here

main() refuses to start with exit 3, so the whole benchmark contour has been unusable since 021. The suite cannot catch it: both lock tests write their own temporary preregistration, so they exercise the mechanism and never the shipped files.

Spec 024's own edit to runner.js (the pytest preflight from T002) is reverted in full — the file is byte-identical to its pre-024 state (925bb5cf…) — and the probe moved into runner.test.js, which is not under the lock: it does not take part in the measurement, it checks it.

The hash is deliberately not updated. The file declares immutableAfterFirstResult: true and writer-results.jsonl is non-empty, so editing those fields is forbidden by the artifact itself, and what to do about results recorded under an unregistered runner is the measurement owner's call, not a slice's. A lock test comparing the shipped preregistration against the shipped runner is likewise not added: it would be red today, and a red test in the suite is a closed door for every other slice. Both wait on your decision.

Test plan

Measured on Linux, Node 22.22.2, clean tree, after rebasing onto the merged main.

node tools/elt-oracle-runner.js --full   # 118/118 — exit 0
node tools/gen-agents-md.js --check      # копии совпадают с CLAUDE.md — exit 0
node bin/doctor.js                       # exit 0
node tools/version-check.js              # ok — 5.0.1 (six sources)

Regressions in this branch:

• tools/elt-tree-hash.test.js — three new cases: a tracked-file rewrite stays visible under diff.noprefix; a rename is refused identically before and after git add -A, and a slice containing a move commits cleanly under the managed hook; a Cyrillic-named file's edit is seen (verified discriminating by removing the flag).

• tools/elt-commit-proof.test.js — the two tests written for the wrong ran === 0 rule are replaced by tests of the correct behaviour: a warm cache passes the gate, and elt gate --ci is proven to carry ELT_ORACLE_FULL=1 across the process boundary (the oracle is a shell string, not argv).

• tools/harness-schema.test.js — the exact config that used to validate is rejected; retired fields are named as retired; the repo's own config passes with zero warnings; and a coverage test lists every field the code reads, review included.

• tools/version-check.test.js — six sources, and each one alone can break the check.

• benchmarks/gemini-3.7-flash-high/runner.test.js — an honest skip naming the missing dependency, with the probe living in the test rather than in the locked runner.

• full suite exits 0

• instruction drift check exits 0

• the smallest regression for this branch exists (or the change is trivial)

🤖 Generated with Claude Code

https://claude.ai/code/session_01ADgXkZxYt9KBYyjnPGCQeF