CI convicted ALL 174 checked tags while the pre-push hook was green. Cause, read from the run log
rather than guessed at the second attempt: the search used `grep -rnE --include=…`, and the CI
runner's image carries python3 and git and deliberately little else — its grep does not support
`--include`, so stdout was empty and the gate read empty as "the tag is absent".
That is a gate silently treating a tool failure as a finding, which is worse than no gate, and it is
exactly the error-swallowing this repo forbids. A green from it would have been just as untrustworthy
as the red.
Fixed by removing the dependency, not by working around it: the search is now pure Python — one
token index per receiving repo, built in a single pass, no subprocess. Faster too (one walk instead
of ~350 greps), and unreadable-file / empty-repo cases now exit 2 INCONCLUSIVE rather than reporting
absence.
THE BEFORE CAPTURE WAS RE-VERIFIED, NOT RE-GENERATED — the stronger claim. All 40 fields recorded in
BEFORE.md were re-tested against the new implementation: agree=40, disagree=0, i.e. exactly the four
this session fixed are now present and the other 36 still absent. The number 40 stands under both
implementations; only the mechanism changed. The whole-token property survives by construction — a
token index treats `healed_at` and `privsep_healed_at` as distinct tokens.
This is the THIRD instrument defect this gate's own controls caught before it was trusted, after the
substring false negative and the dr_recipe over-opacity. The first two were caught by re-finding the
known instances; this one by the CI-versus-hook disagreement the workflow's alarm mail explicitly
says outranks whatever the push was for.
Campaign 12 ranked this first of eight gating candidates. It is built BEFORE the fixes it finds,
because last night an off-the-shelf tool for a neighbouring class (deadcode, for C6) was made to
prove itself first and found NEITHER of the two defects it was meant for. A gate nobody has watched
fail has not been shown to work.
scripts/wire_contract_gate.py, registered in repo_gates.py as --fast (no network, no container, so
it runs in BOTH the pre-push hook and CI — the R-29 constraint).
THE TEST. For every json tag reachable from a declared wire ROOT, does that literal tag occur
anywhere in the receiving repo's production Go or templates? A tag occurring nowhere cannot be
decoded by any struct, named OR anonymous. That last clause is why a string test is used instead of
comparing struct to struct: Campaign 12's first attempt paired types by shape and false-positived
badly, because the hub decodes one report through several ad-hoc anonymous structs.
RESULT ON TODAY'S TREE: 210 tags checked across 3 declared wires, 51 skipped (generic / opaque /
allowlisted), 40 CONVICTED. Captured verbatim in documentation/tests/wire-contract-gate-2026-08-08/
BEFORE.md, which is deliverable 1 of this session.
The prompt for this session said "465 emitted tags, eight unreachable". Checked against the repo
rather than quoted: R-260's wording was "at least eight DECISION-BEARING facts", not eight tags in
total. The real count on the three declared wires is 40, and R-260's own census already listed more
than eight. Recorded because this prompt's own rule 6 says not to quote a document as source.
TWO THINGS THE CONTROL CAUGHT, both before the gate was trusted:
1. A SUBSTRING FALSE NEGATIVE. `grep -F healed_at` also matches `privsep_healed_at`, so a genuinely
dropped field read as received — and R-260 named healed_at, so its absence from the output was
the tell. Now a whole-token regex; healed_at is convicted.
2. dr_recipe IS NOT WHOLLY OPAQUE. The hub stores each half as json.RawMessage and re-emits nested
shapes verbatim, so the LEAVES are genuinely not on this wire. But the TOP-LEVEL SECTION KEYS are
decoded by hostHalfShape/appHalfShape, and those are ALLOW-LISTS: a section an emitter adds is
silently dropped until named in both. That already cost `offsite_restic` (R-122). So the gate is
opaque BELOW depth 1, not opaque — the sections are checked and pass.
Self-test: `--selftest` plants an unreachable tag on a real root in a throwaway copy and asserts
conviction. Verified: exit 1, planted tag named.
Blind spots are in the module docstring AND in the gate's own output, because Campaign 12's C1 guard
turned out blind to one of the three shapes it was written for: generic tag names are not checked;
reachability of a NAME is not use of a VALUE; only declared ROOTS are covered, and the hub's
desired-state (served as raw stored JSON, no typed emitter) and the agent local API are NOT.
Allowlist entries carry a stated reason. A quiet exclusion is a dropped field with paperwork.
Not pushed alone: the fixes follow in the next commit so main is never red on this check.
admin