From a0d63f44ca1997a5f765e5c3a05510d7c24e6a1c Mon Sep 17 00:00:00 2001 From: David F Glidden Date: Wed, 26 Aug 2026 18:46:48 +0200 Subject: [PATCH] [HARDENING] PENDING-165 AMENDMENT 1: (d) was blind to the damaging occurrence; (c) is not a binary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Jurist correction, accepted. Option (d) as filed reported files that are neither tracked nor pre-commit. The 066a47a occurrence WAS tracked, for four weeks, so the check would have been silent throughout the only occurrence that did damage. It sees deposit and not capture, and capture is the laundering — the item own thesis. Corrected to an allowlist: git/hooks contains exactly README.md and pre-commit, anything else is a finding tracked or not, and anything MISSING is also a finding per REVIEWED-105 section 2. This is the executor own standard — ask which failure class a green check can see — applied to the executor filing by the other party. Recorded as an instance of Constraint 6 rather than quietly repaired. Option (c) decoupled: the 552 LFS objects are local, so a cold archive preserves the backup byte-for-byte and git-lfs is needed only at restore. Precondition measured, which was the executor figure to supply: 399 of 399 tracked files resolve from local objects, 0 remote-only. COMPLETE, the reframe holds. Keeping the backup and removing the vector are not exclusive. Do NOT run git lfs migrate export on the backup: it rewrites commits and destroys the exact-preservation property that is the snapshot only reason to exist. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NvZAKSf9aqratbqHbU9LK5 --- PENDING.md | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/PENDING.md b/PENDING.md index 5bbefdf..0194051 100644 --- a/PENDING.md +++ b/PENDING.md @@ -6040,3 +6040,42 @@ The jurist asked: does the directory carry a *governed* hook under any of those **Files affected:** `~/dotfiles/git/hooks/` (shims removed, twice, not otherwise modified); `Brewfile:40` (not modified). **Awaiting:** Steward authorization. + +### PENDING-165 — AMENDMENT 1: option (d) was blind to the only occurrence that did damage; option (c) is not the binary the item drew +**Date:** 2026-08-26 +**Raised by:** the jurist. **JOINS the item; replaces nothing.** Both corrections accepted; the (c) precondition measured by the executor, whose figure it was. + +**(1) ⚠ OPTION (d) AS FILED IS HOLED, in the shape of the incident it was written for. ACCEPTED.** + +As filed, (d) reports *"any file in `git/hooks/` that is neither tracked nor `pre-commit`."* The `066a47a` occurrence was a **tracked** file: `git add` captured the shims and they sat tracked for four weeks. `not tracked` was false for that entire period, so **the check would have been silent throughout the only occurrence that actually did damage.** It sees deposit and not capture — **and capture is the laundering, which is this item's own thesis.** + +⚠ **This is the executor's own standard, applied to the executor's filing by the other party:** *ask which failure class each green check can actually see.* It was not asked here. The doctrine in Constraint 6 is that biases which fail to coincide catch what one party is not positioned to see; this is an instance, and it is recorded as one rather than quietly repaired. + +**(d), CORRECTED — declare the contents, do not test tracked-ness:** + +> `git/hooks/` contains exactly `README.md` and `pre-commit`. +> **Anything else present is a finding, tracked or untracked.** +> **Anything declared and missing is also a finding** — REVIEWED-105 §2 measured that an absent hook file produces zero output rather than an ambiguous silence, so absence must be asserted, not inferred. + +An allowlist sees the deposit *and* the four-week tracked state. A tracked/untracked test sees only the first. The allowlist also needs no knowledge of git-lfs, so it does not go stale if the vector changes. + +**(2) OPTION (c) IS NOT THE BINARY THE ITEM DREW, and the precondition is now measured. ACCEPTED.** + +The item presented (c) as *keep the backup* **or** *remove the vector*. The jurist's decoupling: the 552 objects are **local**, so a cold archive of the whole directory — `.git` and `.git/lfs/objects` included — preserves it byte-for-byte and needs no git-lfs to *hold*. git-lfs is required only at **restore**, which is a deliberate act and a `brew install` away. + +**The precondition the jurist named and could not measure, measured:** + +| | | +|---|---| +| LFS-tracked files at HEAD | **399** | +| resolving from local objects | **399** | +| remote-only (would break the archive) | **0** | +| object files on disk | 552 (975 MB) — more than 399 because history carries prior versions | + +**COMPLETE. The reframe holds.** (c)'s cost is therefore *one archive operation now, one reinstall if ever restored* — not *strand a 975 MB safety copy*. The steward can keep the backup **and** remove the vector; the item was wrong to present them as exclusive. + +⚠ **DO NOT run `git lfs migrate export` on the backup.** It is the obvious-looking move and it rewrites commits, destroying the exact-preservation property that is the entire reason the snapshot exists. Recorded here because the next reader will think of it. + +**Recommendation, revised: corrected-(d) first, then (b) once (d) is live, and (c) available on the archive route whenever the steward wants the vector gone.** (c) is no longer gated on retiring the backup. + +**Awaiting:** Steward authorization. Nothing here is built; this corrects a specification before it is implemented, which is the cheapest point at which this correction could have landed.