[FIX] register integrity: an amendment must never replace the record it amends
REVIEWED-87's original entry (PENDING-99, the fidelity_equivalence@3 design-gate ruling of 2026-08-05) was replaced this afternoon by the PENDING-111 amendment block placed at the same heading. The amendment's own "**Amends:** REVIEWED-87" line then pointed at a record no longer in the file, and the register could no longer answer what was ruled under 87 — the register's whole job. Recoverable, and recovered: the entry was intact in git HEAD and the underlying jurist ruling is separately filed at studium-engine/docs/quoted-tier-acceptance-JURIST-RULING-2026-08-05.md. But the register entry uniquely held Q2's reframing (the route to PENDING-100), Q3 REJECTED and its strengthened basis, Q5 CONCUR D-1, and the finding that "the decisive sentence was one the executor had read and not surfaced, which a verbatim-containment check passes every time." CAUSE, and it is the executor's. The handoff draft was headed "## REVIEWED-87 — AMENDMENT 2026-08-07" and described as "the block to place", with no instruction that it join rather than replace. That reads as a replacement heading, and the steward's reading of it was reasonable. The copy-paste-clean discipline exists so a placement cannot be ambiguous, and this draft was ambiguous. NOTHING DETECTED IT. It surfaced because a diff was read by hand and the tell was a deletion count on what should have been a pure append. This is `removing-a-claim-is-not-removing-the-reliance` at the governance layer: the amendment's dependency on the original survived the original's removal and became invisible. Check 7 added to governance-drift-check.py, which already runs at every wake: every `## REVIEWED-N — AMENDMENT` requires an un-amended `## REVIEWED-N` entry, and every `**Amends:** REVIEWED-N` must resolve. Reported separately from the CLAUDE.md findings so that report's own claim stays true. Controls per the standing epistemic standard, and the third is the lesson of the day — a check that has never fired on a known-bad input is unestablished, so the instrument is run against a synthetic reproduction of the actual failure. Red-witnessed on a copy of the live file with the deletion replayed: fires both findings. 11/11 controls pass. Detection only. REVIEWED.md is [ESCALATE], the steward's hand (Constitutional Constraint #1); the restoration above was placed by the steward, not by the executor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NEWjLBP4quXbDPDL2byEzZ
This commit is contained in:
David F Glidden
co-authored by
Claude Opus 5
Claude Opus 5
parent
02a72d017e
commit
bcc02ada3d
@@ -191,6 +191,70 @@ control("doctrine-id citing surface is reachable",
|
||||
(not skills_dir.is_dir()) or scanned > 0)
|
||||
|
||||
|
||||
# ------------------------------------------ 7. register integrity (REVIEWED)
|
||||
# EARNED 2026-08-07, from a real loss. An amendment block was placed OVER the
|
||||
# record it amends: the original `## REVIEWED-87 — PENDING-99 — …` entry was
|
||||
# replaced by `## REVIEWED-87 — AMENDMENT 2026-08-07`, leaving the amendment's
|
||||
# own `**Amends:** REVIEWED-87` line pointing at a record no longer in the file.
|
||||
# The content was recoverable from git and the underlying jurist ruling was
|
||||
# filed separately, so nothing was lost — but NOTHING DETECTED IT. It surfaced
|
||||
# because a diff was read by hand, and the tell was a deletion count on what
|
||||
# should have been a pure append.
|
||||
#
|
||||
# The class: a register whose entries can silently replace one another cannot be
|
||||
# trusted to answer "what was ruled under N", which is the register's whole job.
|
||||
# This is `removing-a-claim-is-not-removing-the-reliance` at the governance
|
||||
# layer — the amendment's dependency on the original survived the original's
|
||||
# removal, and became invisible.
|
||||
#
|
||||
# Detection only, like every check here: REVIEWED.md is [ESCALATE], the
|
||||
# steward's hand (Constitutional Constraint #1).
|
||||
REVIEWED_MD = HOME / "dotfiles" / "REVIEWED.md"
|
||||
|
||||
RE_HEAD = re.compile(r"^##\s+REVIEWED-(\d+)\s*[—-]\s*(.*)$", re.M)
|
||||
RE_AMENDS = re.compile(r"\*\*Amends:\*\*\s*REVIEWED-(\d+)")
|
||||
|
||||
|
||||
def register_findings(text: str, label: str) -> list[str]:
|
||||
"""Every amendment must sit ALONGSIDE the record it amends, never replace it."""
|
||||
out: list[str] = []
|
||||
heads = RE_HEAD.findall(text)
|
||||
originals = {n for n, rest in heads
|
||||
if not rest.strip().upper().startswith("AMENDMENT")}
|
||||
for n, rest in heads:
|
||||
if rest.strip().upper().startswith("AMENDMENT") and n not in originals:
|
||||
out.append(f"{label}: '## REVIEWED-{n} — AMENDMENT' exists with no "
|
||||
f"un-amended REVIEWED-{n} entry — the amendment replaced "
|
||||
f"the record it amends")
|
||||
for n in sorted(set(RE_AMENDS.findall(text))):
|
||||
if n not in originals:
|
||||
out.append(f"{label}: a block declares '**Amends:** REVIEWED-{n}' but "
|
||||
f"no REVIEWED-{n} entry exists in the file")
|
||||
return out
|
||||
|
||||
|
||||
reg_findings: list[str] = []
|
||||
if REVIEWED_MD.exists():
|
||||
reg_findings = register_findings(REVIEWED_MD.read_text(errors="replace"),
|
||||
"REVIEWED.md")
|
||||
|
||||
# Controls. The third is the one that matters and is the lesson of the day:
|
||||
# a check that has never fired on a known-bad input is unestablished, so the
|
||||
# instrument is run against a synthetic reproduction of the actual failure.
|
||||
_GOOD = ("## REVIEWED-87 — PENDING-99 — original\n**Date:** 2026-08-05\n\n"
|
||||
"## REVIEGH\n\n## REVIEWED-87 — AMENDMENT 2026-08-07\n"
|
||||
"**Amends:** REVIEWED-87 (x).\n")
|
||||
_BAD = ("## REVIEWED-87 — AMENDMENT 2026-08-07\n"
|
||||
"**Amends:** REVIEWED-87 (x).\n")
|
||||
control("register parser finds REVIEWED headings", len(RE_HEAD.findall(_GOOD)) == 2)
|
||||
control("register check passes a correctly JOINED amendment",
|
||||
not register_findings(_GOOD, "t"))
|
||||
control("register check DETECTS an amendment that replaced its record "
|
||||
"[reproduces the 2026-08-07 loss]",
|
||||
len(register_findings(_BAD, "t")) == 2)
|
||||
control("register file is reachable", REVIEWED_MD.exists())
|
||||
|
||||
|
||||
# ------------------------------------------------------------- report
|
||||
failed_controls = [lbl for lbl, ok in controls if not ok]
|
||||
if failed_controls:
|
||||
@@ -210,4 +274,20 @@ else:
|
||||
print("\n Correction requires [ESCALATE] (Constitutional Constraint #1). "
|
||||
"This report is detection only.")
|
||||
|
||||
# Register integrity is reported SEPARATELY. Folding it into the count above
|
||||
# would make that line's own claim false — it says "claim(s) in ~/CLAUDE.md",
|
||||
# and these are findings about a different file.
|
||||
if reg_findings:
|
||||
print(f"\n⚑ register integrity: {len(reg_findings)} broken amendment link(s) "
|
||||
f"in ~/REVIEWED.md")
|
||||
for f in reg_findings:
|
||||
print(f" {f}")
|
||||
print("\n An amendment must sit alongside the record it amends, never replace it.")
|
||||
print(" Correction requires [ESCALATE] — REVIEWED.md is the steward's hand.")
|
||||
elif REVIEWED_MD.exists():
|
||||
n_am = sum(1 for _, r in RE_HEAD.findall(REVIEWED_MD.read_text(errors="replace"))
|
||||
if r.strip().upper().startswith("AMENDMENT"))
|
||||
print(f"✓ register integrity: every amendment link resolves "
|
||||
f"({n_am} amendment(s) checked)")
|
||||
|
||||
sys.exit(0)
|
||||
|
||||
Reference in New Issue
Block a user