ci: run the three spec guards that nothing was running - #3427
Merged
Conversation
Closes #3426 Three checkers were written over the last passes, each after a defect it would have caught, and each has since caught a live one: check_seal_currency.py 116 seals described output the compiler had stopped producing, and spec_hash was stale for ZERO of them, so every existing coverage and staleness check was green (#3415) check_ring_spec_drift.py one of ten ring/spec pairs had drifted (#3422) ring_spec_differential.py 126 of 1190 cases disagreed behind 16 of 16 identical signatures (#3420, #3424) All three ran only when someone typed them. I deferred this three times as a cost decision for the owner. Measured, it is not one: 12s for the seal scan, 0s for the drift scan, ~1s per differential pair, ~1s for all three self-checks, on top of a compiler build the repository already pays for elsewhere. That is the third time this session I called something a decision without measuring it first. Four things the workflow does deliberately: * Self-checks run FIRST, in their own steps. A checker whose own negative control fails cannot be believed when it then reports zero, and sharing a step would let a green scan hide a broken instrument. * The CONVERGED pair list is derived from `check_ring_spec_drift.py --converged`, not written into the YAML, because a hard-coded list goes stale the first time a pair converges. An empty list FAILS the step rather than looping zero times and reporting success. * It is not a required context and must not become one without the owner: a paths-filtered workflow that is required hangs every pull request it does not match on a check that never posts. A `push:` trigger is included so master has a baseline at all. * `while read`, not `mapfile`. mapfile is bash 4+ and macOS ships bash 3.2, so that step could not have been run locally before pushing it -- a construct only the runner can execute is one nobody tested. The loop, the empty-list guard and the final-line-without-a-trailing-newline case were each run verbatim under bash 3.2. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
gHashTag
enabled auto-merge (squash)
September 7, 2026 22:29
Contributor
|
📓 NotebookLM Notebook linked to this PR
This notebook contains session context, decisions, and artifacts for this work. |
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3426
Three checkers were written over the last passes, each after a defect it would have caught, and each has since caught a live one. All three ran only when someone typed them.
check_seal_currency.pyspec_hashstale for zero of them, so every existing check was greencheck_ring_spec_drift.pyring_spec_differential.pyCost — measured, and it was never a decision
I deferred this three times as "a cost decision for the owner":
On top of a
cargo build --release -p t27cthe repository already pays for elsewhere. That is the third time this session I called something a decision without measuring it first.Four deliberate choices
--convergedprints it, because a list in the YAML goes stale the first time a pair converges. An empty list fails the step rather than looping zero times and reporting success — verified with a control that exits 1.paths:-filtered workflow that is required hangs every PR it does not match, forever, on a check that never posts — measured earlier at 15 of 40 merged PRs forcli-tri. Apush:trigger is included so master has a baseline at all; a paths-filtered workflow without one runs zero times on the default branch.while read, notmapfile.mapfileis bash 4+ and macOS ships bash 3.2, so that step could not have been run locally before pushing it. A construct only the runner can execute is one nobody tested. The loop, its empty-list guard, and the final-line-without-a-trailing-newline case were each run verbatim under bash 3.2:The display name
Spec Guardsis unique across all workflows — checked, because two workflows sharing a display name is howcli-tribecame unnameable in the ruleset.