diff --git a/PENDING.md b/PENDING.md index e3b79c6..54cb90b 100644 --- a/PENDING.md +++ b/PENDING.md @@ -6110,3 +6110,24 @@ Neither number is a census result — both are haystacks. The specification has ⚠ **The read-only guarantee was extended, and doing so found a pre-existing hole.** `governance-mcp.py` proves read-only-ness by AST **over itself**; adding a delegate put code outside that proof. Extending it to delegates surfaced (a) a **false-positive class** — bare `.replace` flagged `str.replace()`, which is why the guarantee had never been extended past one file — and (b) that `wake-digest.py`, a delegate **since before today**, was never covered. Its only real mutation is `emit_brief()`, its SessionStart-hook role, unreachable from any tool. Now handled by **declared exemption per delegate**, so a new mutating function fails until someone names it and says why — the same shape as PENDING-165's allowlist, and for the same reason. **Awaiting:** nothing on (c)/(d). The 270-candidate classification pass is unscheduled and unclaimed. + +### PENDING-165 — STEWARD INSTRUCTION, 2026-08-26, deferred to 2026-08-27 +**Recorded verbatim so it is not lost to the session boundary:** + +> *"as for the snapshot, let's deal with that tomorrow and move it to the same drive i have the decommissioned mempalace stuff on"* + +and, earlier in the same exchange: + +> *"I no longer need the snapshot, the repo has been behaving normally and we've been working with it with no problems."* + +**What this settles:** option **(c)** — removing `git-lfs` and with it the vector entirely — is no longer gated on preserving `~/_Dev/chamber-library.pre-lfs-export-20260605` in place. The snapshot moves to the external drive holding the decommissioned MemPalace material. + +**What it does NOT settle, and what must be checked before the move:** +- ⚠ **Move, do not `migrate export`.** Rewriting commits destroys the exact-preservation property that is the snapshot's only reason to exist (jurist, 2026-08-26). +- ⚠ **The move must carry `.git/lfs/objects` — 552 objects, 975 MB.** A copy that takes the working tree and not the LFS store leaves 399 unreadable pointer files. **Verified 2026-08-26: all 399 tracked files resolve from local objects, 0 remote-only**, so a whole-directory copy is complete — and only a whole-directory copy is. +- ⚠ **Verify by reading back at the destination**, not by the copy returning success. The same rule that governs the transcript archive and that was learned on MemPalace — whose decommissioned material is, fittingly, the destination. +- ⚠ **`git-lfs` must still be installed at the moment of any future restore.** Removing it under (c) is safe only because reinstalling is a `brew install`; that fact belongs with the archive, not only here. + +**Sequence, for tomorrow:** move + read-back verify → then (c) is free → then `Brewfile:40` and the PENDING-165 (b)/(d) guards become belt-and-braces rather than the only defence. + +**Awaiting:** the steward, 2026-08-27. Nothing for the executor tonight. diff --git a/REVIEWED.md b/REVIEWED.md index d5415ae..9f252a7 100644 --- a/REVIEWED.md +++ b/REVIEWED.md @@ -2349,4 +2349,84 @@ figure on 2026-08-01 and repeated it for three weeks; anyone citing 55 is citing **Consequential `[FIX]` on §9, corrected in flight and now largely moot.** The jurist first said the clause should read that the executor yields *"since it's the only party that can"*, and the executor applied that as given. Both were wrong in the same direction: the clause is *"a disjunction, and the executor half is implementable and correct… one live branch and one unreachable one."* Only the jurist is struck from the disjunction. ⚠ The executor's separate failure is recorded in the item: **a `[FIX]` tag licenses implementing directly, not implementing UNREAD.** -**If REJECTED:** Nothing is built and nothing is to be built. *"If anything gets built for this, the ruling has been reversed by construction."* No script, no field, no counter, no status line. PENDING-159 closes. **Tarbuckle reaches the steward and stops, and what the steward carries is his own.** \ No newline at end of file +**If REJECTED:** Nothing is built and nothing is to be built. *"If anything gets built for this, the ruling has been reversed by construction."* No script, no field, no counter, no status line. PENDING-159 closes. **Tarbuckle reaches the steward and stops, and what the steward carries is his own.** + +## REVIEWED-130 — PENDING-163 — The pre-commit size guard's printed remedy +**Date:** 2026-08-26 +**Decision:** AUTHORIZED — option (i), reworded per two jurist edits. Option (ii) REJECTED on the +merits. Option (iii) withdrawn as already built. +**Notes:** + +1. RETROSPECTIVE IN PART, and recorded as such. The message change landed at 2408032 on the +steward's in-session 'go', before this block was drafted. This ruling records that authorization; +it does not precede it. The line-45 whitespace [FIX] (ecee76b) landed earlier under executor +authority and required no ruling. + +2. WHAT WAS WITHDRAWN, and it is the reason the item reached the steward at all. The item's claim +that option (ii) 'widens what may be committed everywhere' is false by a category: +`git cat-file -s :"$file"` reads the staged blob, so an LFS-tracked file measures ~133 bytes and a +plain file still measures its full size and is still refused. (ii) admits exactly what someone +deliberately declared. Withdrawn by the executor as false (Amendment 2). The error made (i) look +safer and (ii) costlier than either was, and that mis-sizing is what constituted the 'policy +question'. + +3. OPTION (ii) REJECTED ON THE MERITS, NOT DEFERRED ON THE ENDPOINT. Two grounds exist and they +have different lifespans. The contingent one — git.skemantix.com serves no LFS endpoint — would +support only a DEFERRAL, since a repo pointing elsewhere changes it. The merits ground does not: +LFS stores a full opaque blob per version and cannot delta, measured today at 6 MB versus 18 MB in +`.git` after eight commits of the same file. For append-only text LFS is the wrong storage model, +and the JSONL transcripts that surfaced this item are its worst case, not a marginal one. This was +already the steward's finding at chamber-library 0677e8a (2026-06-05), where LFS was retired and +seventeen commits of history rewritten to undo it. REJECTED rather than DEFERRED deliberately: a +deferral would invite re-litigation on the weaker of the two reasons. + +4. OPTION (iii) WITHDRAWN, dead twice over. Its appeal to REVIEWED-100 inverted that ruling's +polarity — a `.precommit-triggers` declaration causes checks to RUN, and (iii) would have used the +same file to make a global check NOT run — and the parser rejects any line lacking `|` as +malformed, so an exemption line is not awkward but refused. It is also already built: 400c054 gives +chamber-library a repo-local hook exempting corpus text by path. Per-repo, in-repo, versioned, no +new parser. + +5. THE CENSUS, required by this ruling before the ecee76b [FIX]'s permission change could be called +harmless. 87 commit-eligible files over 5 MB across 37 repos (positive control: the scan sees large +files); 10 of those carry whitespace in the name; 0 currently modified or staged. Traced rather +than assumed: chamber-library runs its own core.hooksPath, and the vault mirror commits with +`--no-verify` at obsidian_vault_sync.sh:64. Reachable surface is two quiescent corpus files. The +10 are themselves evidence the hole was load-bearing — they could only have entered through it. +The executor's claim that ecee76b 'narrows nothing, widens nothing' is withdrawn (Amendment 2): it +is true against the specification and false against practice, and it is the kind of sentence that +later reads as a licence. + +6. THE CENSUS'S OWN FIRST RUN returned a clean zero having measured nothing — a zsh loop that does +not word-split on newlines, iterating once over the concatenated string, the same failure class as +the bug under measurement. Caught by an echoed error, not by design. The re-run carries the +positive control so that a zero cannot again mean 'did not look'. Third instance in this thread of +an instrument failing in the class it was measuring; routed to PENDING-139 and PENDING-160 as a +datum, not re-filed. + +7. THE TWO MESSAGE EDITS, and why each was required. (a) The draft hardcoded `git.skemantix.com +serves no LFS endpoint` — a present-tense substrate claim, inside a script, in a hook global to 37 +repos, unverifiable by the hook that prints it and checked by nothing. That is PENDING-144's open +class. Replaced with a dated historical reference to chamber-library 0677e8a, which does not go +stale. (b) The draft led its remedy with `git config --local core.hooksPath .githooks`, which does +not exempt large files — it stops the global hook running in that repo entirely, taking the secrets +check and the declared-checks machinery with it. Advertising that as the standard response to a +routine refusal reproduces REVIEWED-105's failure mode: someone runs the config line without +copying the hook and holds an unguarded repo that looks governed. Reordered to copy the hook +(400c054), add the exemption there, config line last. + +8. JURIST ERROR, recorded rather than smoothed. Two. The claim that `wc -c` runs on staged +deletions was false — line 46 carries `[ -f "$file" ]`, and the inference reasoned about lines the +item had not quoted as though absence from a quotation were absence from the file. The whitespace +bug the executor then found at line 45 is the executor's finding, not a vindicated instinct. And +the recommendation of (ii) was placed ahead of a check whose answer voided it; the condition was +correctly identified, the ordering was wrong. + +9. CARRIED FORWARD. The finding that outranks this ruling is filed separately as PENDING-164: the +decision at 0677e8a is absent from the entire authorization record, so no instrument available to +the jurist could have reached it. Also carried forward, unfiled at time of writing: git-lfs +re-installs shims into the global hooks directory, observed recurring twice on 2026-08-26. + +**If AUTHORIZED:** Message change already at 2408032; controls run (whitespace 6 MB refused and +printing the new text, plain 6 MB refused, small file committed). No further executor action on +PENDING-163. Close PENDING-163. Tag nothing new with REVIEWED-130. \ No newline at end of file