From 74d3ea9e4e86956f43fae1e1cb757676c8e93c35 Mon Sep 17 00:00:00 2001 From: David F Glidden Date: Wed, 26 Aug 2026 18:14:38 +0200 Subject: [PATCH] [HARDENING] PENDING-163 AMENDMENT 2: the measurement, and the record that kills (ii) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Withdraws "narrows nothing, widens nothing" as the jurist required. True against the specification, false against practice: before ecee76b a >5MB whitespace-named file committed successfully in every repo under the global hooksPath. The [FIX] tag holds; the sentence must not, because it later reads as a licence. The measurement REVIEWED-105 §3 called for: 37 repos (not ten), 87 commit-eligible files over 5MB, of which 10 have whitespace in the name, of which 0 are currently modified. Traced per repo rather than assumed: chamber-library has its own hooksPath with a corpus exemption, and the vault mirror commits --no-verify, so neither runs this hook. Reachable surface is two quiescent corpus files. The first run of that measurement returned a FALSE ZERO — a zsh loop that did not word-split on newlines, iterated once over the concatenated string, and printed "NONE" having measured nothing. Same class as the bug under measurement, inside the measurement of it. The re-run carries a positive control so a zero cannot again mean "did not look". And the part that matters: the jurist's condition on authorizing (ii) — does the remote serve LFS — is answered NO by the record, not by inference. chamber-library 0677e8a, 2026-06-05: "LFS was a misfit... the Gitea remote carries no LFS endpoint, so pointers made the remote a non-backup." Seventeen commits of history were rewritten to undo it. (iii) is likewise already built: 400c054 gives chamber-library a repo-local hook exempting corpus text by path. (ii) REJECTED on evidence. (iii) WITHDRAWN as already-built. Recommendation is the reworded (i), which should stop naming LFS entirely and point at the per-repo hooksPath route that already works. Two AI parties reasoned toward a mechanism the steward had already tried and retired. The jurist could not check. The executor could, and did not, until "pre-lfs-export" showed up in an unrelated directory listing. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NvZAKSf9aqratbqHbU9LK5 --- PENDING.md | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/PENDING.md b/PENDING.md index dc5b852..28d3750 100644 --- a/PENDING.md +++ b/PENDING.md @@ -5893,3 +5893,53 @@ central finding is that care is not a mechanism. - **(i) vs (ii) remains the steward's**, but is now a much smaller question than the item posed: not *"may large files enter these repos"* but *"may a repo exempt a declared class by committing a `.gitattributes` line."* **Awaiting:** steward authorization on (i) vs (ii) only. The `[FIX]` is not awaiting. + +### PENDING-163 — AMENDMENT 2: the measurement the jurist required, and the banked record that kills (ii) +**Date:** 2026-08-26 +**Raised by:** the jurist (REVIEWED-105 §3 precedent — make "narrows nothing" a measurement, not an assumption; and: is (ii)'s remote LFS-capable?). **JOINS Amendment 1 and the item; replaces neither.** + +**(1) "Narrows nothing, widens nothing" is WITHDRAWN as written.** The jurist is right: it is true against the specification and false against practice. Before `ecee76b`, a >5 MB file whose name contained whitespace committed successfully in every repo under the global hooksPath; after it, refused. That is a change to what the hook permits, globally, effective immediately — the exact property PENDING-163 gave as its reason for not touching the hook. The `[FIX]` tag holds (restoring specified behaviour), but **the sentence must not stand, because it is the kind of claim that later reads as a licence.** + +**(2) The measurement. The answer is NOT zero — it is 10.** + +| | | +|---|---| +| git repos under the global hooksPath | **37** (not ten) | +| commit-eligible files >5 MB, any name | 87 ← *positive control: the scan can see large files* | +| **of those, with whitespace in the name** | **10** | +| of those 10, currently modified or staged | **0** — all tracked and clean | + +⚠ **The 10 are evidence the hole was load-bearing: they could only have entered git because the check could not run.** Five are vault PDFs (tax records, a lease, a clinical report on Lune, a POA), five are chamber corpus texts (Proust, Montaigne, Primo Levi). + +**Exposure, traced per repo rather than assumed:** +- `chamber-library` and its pre-LFS backup — `core.hooksPath=.githooks`, a **repo-local hook that already exempts corpus text by path** (`400c054`). The global hook never runs there. **Unaffected.** +- `david-root-and-branch-vault-git` — syncs hourly, but `obsidian_vault_sync.sh:64` commits with **`--no-verify`**. The hook never runs there either. **Unaffected.** +- `davidglidden.github.io` — global hook, **2** whitespace corpus files, both clean. **This is the entire reachable surface, and only if someone modifies those two files.** + +**⇒ Corrected claim: the fix narrows a two-file surface that is currently quiescent.** Not "nothing", and stated as a measurement. + +**(3) ⚠ THE MEASUREMENT FIRST RETURNED A FALSE ZERO, and the near-miss belongs in the record.** The first attempt was a zsh loop over `$repos`; zsh does not word-split on newlines, so `for r in $repos` iterated **once** over the whole concatenated string, every `cd` failed, and it printed *"NONE — zero commit-eligible files have whitespace in their name."* **A clean zero, having measured nothing.** It was caught only because the failed `cd` echoed the concatenated path. **This is the same class as the bug being measured — a check that passes because it could not run — occurring inside the measurement of that class, in the same hour, by the party that had just written it up.** The re-run carries a positive control (87 large files seen) precisely so a zero cannot again mean "did not look". + +**(4) The jurist's LFS-remote question is answered by the record, and the answer kills (ii). RECORD, NOT INFERENCE.** + +`chamber-library` commit **`0677e8a`, 2026-06-05** — *"chore: retire LFS — corpus is plain text in git proper"*: + +> *"LFS was a misfit for a write-once markdown corpus — git delta-compresses text natively and **the Gitea remote carries no LFS endpoint, so pointers made the remote a non-backup**. History rewritten via `git lfs migrate export` (all 17 commits)."* + +**This is precisely the failure the jurist raised as (ii)'s remaining cost — and it has already happened here, on this machine, and was undone at the cost of rewriting seventeen commits of history twelve weeks ago.** `git.skemantix.com` serves no LFS endpoint. The condition the jurist attached to authorizing (ii) therefore **fails on evidence already in the repo**. + +**(5) (iii) does not need building either — it exists, and in a better form than `.precommit-triggers`.** `chamber-library` sets `git config --local core.hooksPath .githooks` and ships a repo-local hook exempting `canonical_texts/**` and `converted_texts/**` by path (`400c054`, whose message cites `0677e8a` as its reason). Per-repo, in-repo, versioned, diff-visible — the property (iii) wanted — **with no change to the global hook and no new parser.** + +**⇒ Recommendation reverses again, and this time on the banked record rather than on reasoning: (i), REWORDED FURTHER.** The advice must stop naming LFS at all. LFS is not merely unhelpful against this check — it is a mechanism this machine's main remote cannot serve and that the steward deliberately retired. The message should point at the route that already works: + + Error: is larger than 5MB + The ceiling is on the working-tree file; Git LFS does not exempt it, + and git.skemantix.com serves no LFS endpoint (see chamber-library 0677e8a). + If this repo legitimately holds large files, give it its own hook: + git config --local core.hooksPath .githooks (see chamber-library 400c054) + +**⇒ (ii) REJECTED on evidence. (iii) WITHDRAWN as already-built.** + +⚠ **What this episode is evidence for.** Two AI parties independently reasoned their way to recommending a mechanism the steward had tried, documented, and retired — and neither consulted the repository history until the third pass. The jurist could not (no substrate access). **The executor could, and did not, until the word "pre-lfs-export" appeared in an unrelated directory listing.** That is *answer-from-reasoning-before-banked-record*, at the point where a ruling was being drafted. + +**Awaiting:** steward authorization on the reworded (i) only.