admin
9167cf53af
gates / gates (push) Successful in 23s
The hub has written every customer e-mail in Hungarian whatever the box was set to. The box has published its language since controller v0.247.0; nothing read it. Now it does. Nothing an operator reads changes. The Hungarian mails are byte-identical, and that is a diff rather than a reading: 56 goldens per language captured from v0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after every sentence was routed through the new bundle. - internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0. - customerMessages/severityLabels are DERIVED from the bundle, so a sentence is written in one place and all 40+ tests that read those maps still work. - Language order: last reported -> created-with -> hu. reports.language defaults to EMPTY, never hu: "never told us" is not "chose Hungarian". - message_customer on POST /api/v1/event, additive and optional forever, for the sentences the box composes and the hub cannot translate. - The bind page is per-language, and its `expired` state stays Hungarian: it is the state an unknown token lands in, so rendering a real English customer's token in English would make the LANGUAGE answer what the TEXT refuses to. Two defects found inside the release: - R-581: the newest report was picked by received_at, which has SECOND granularity, so same-second reports tied and the winner was arbitrary. Ordered by the autoincrement id now. GetCustomers() still has the shape - row open. - R-582: the English copy-guard stems, ported word for word from Hungarian, convicted 141 honest sentences. The English claim is a phrase with a modal. R-555 closed: the language allowlist entry is out of wire_contract_gate.py. hub_copy_gate.py follows the sentences into the bundle - without that it would have scanned four files that no longer hold any customer text and reported success. Three new decoys incl. an innocent control. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
108 lines
7.3 KiB
Python
108 lines
7.3 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""customer_copy_vocab — THE ONE list of customer-copy vocabulary, shared by both repos.
|
|
|
|
WHY THIS FILE EXISTS AT ALL. Two guards need the same words: the controller's
|
|
`retrieval_promise_gate.py` (which scans the box's own screens) and this repo's `hub_copy_gate.py`
|
|
(which scans the hub's e-mails and binding pages). Two copies of a word list is not a theoretical
|
|
risk here — it is the R-299 defect exactly: a guard asserted one inflection of a Hungarian verb and
|
|
the plural, one paragraph above, walked straight past it. A second list drifts the same way.
|
|
|
|
So the list lives HERE, in `felhom.eu/scripts/`, which is already the established home for gates both
|
|
repos consume without copying (`reuse_refs_check.py`, `instructions_gate.py` — the controller's own
|
|
`controller_gates.py` runs them from this directory and FAILS when the sibling clone is absent, which
|
|
is the fail-CLOSED shape a shared gate needs).
|
|
|
|
⚠ ADOPTION IS HALF DONE, AND SAYING SO IS THE POINT. `hub_copy_gate.py` imports this module.
|
|
`felhom-controller/controller/scripts/retrieval_promise_gate.py` still carries its own `STEMS`
|
|
literal, because the session that wrote this module was under a hard end-state requirement to leave
|
|
felhom-controller untouched (its target box was being re-deployed the same evening). Until that gate
|
|
imports this file, `hub_copy_gate.py` DRIFT-CHECKS it: it reads the controller gate's `STEMS` and
|
|
fails if the two lists disagree. That gives single-source semantics tonight without a cross-repo
|
|
edit — but it is a scaffold, not the destination. Register row: R-325.
|
|
"""
|
|
|
|
# ── The retired names ────────────────────────────────────────────────────────────────────────────
|
|
#
|
|
# A name here is BANNED from customer-facing copy outright. Unlike the stems below, these are not
|
|
# claims that might be true in context — they are names for a secret that a different secret now
|
|
# owns, and a customer meeting one is being told two things have the same name.
|
|
#
|
|
# Each entry is a SUBSTRING, deliberately shorn of its leading capital and its ending, so a
|
|
# possessive or accusative form cannot slip past a check written against the nominative:
|
|
# „visszaállító jelszavadat" must convict as surely as „Visszaállító jelszó". That is the R-299
|
|
# lesson applied to nouns instead of verbs.
|
|
RETIRED_NAMES = {
|
|
"isszaállító kód": (
|
|
"R-295 (2026-08-10 box side, 2026-08-13 hub side). The THREE-word code that takes control of "
|
|
"the dashboard is „Beállító kód”. „Visszaállító kód” was a near-homograph of the escrow "
|
|
"„Helyreállítási kód” and the collision cost a real code."),
|
|
"isszaállító jelsz": (
|
|
"R-323 (2026-08-13). The FIVE-word phrase that proves the account owns the box being bound is "
|
|
"„Tulajdonosi jelmondat”. „Visszaállító jelszó” was one word from the name retired above, and "
|
|
"it was false besides — the phrase restores nothing."),
|
|
}
|
|
|
|
# ── The retrieval-promise stems ──────────────────────────────────────────────────────────────────
|
|
#
|
|
# These are NOT banned. Each carries the claim "your old backups can be got back", which is sometimes
|
|
# TRUE and must then be sayable. An occurrence must be REGISTERED with a reason in the consuming
|
|
# gate's allowlist; an unregistered one fails.
|
|
#
|
|
# The docstring of the controller gate is the long version and is worth reading before adding a stem:
|
|
# five instances of this claim surfaced ONE AT A TIME, and the obvious guard (ban the sentence) was
|
|
# tried twice and failed twice.
|
|
RETRIEVAL_STEMS = ["visszaállíthat", "visszaszerezhet", "visszahozhat", "visszanyit"]
|
|
|
|
# ── The same claim, in English (R-558, hub v0.118.0) ─────────────────────────────────────────────
|
|
#
|
|
# Localisation slice 3 gave the hub an English bundle, so every sentence these guards exist for can
|
|
# now be written twice. A guard that reads only the Hungarian half would be HALF A GUARD, and the
|
|
# English half is the one nobody has years of habit reading carefully.
|
|
#
|
|
# ⚠ THESE ARE REGEXES, AND THEY MATCH A CAPABILITY CLAIM — NOT A WORD.
|
|
#
|
|
# The first attempt at this list was the bare stems "restor" and "recover", and it convicted 141
|
|
# sentences on its first run: „node_recovered" („Your server can be reached again"), „Disaster
|
|
# recovery has started", the Restore PAGE NAME. That is not a near miss, it is the wrong instrument:
|
|
# in Hungarian the stems ARE the claim, because „visszaállíthat" is a single word meaning *can
|
|
# restore*. English splits the modal from the verb, so the English form of the claim is a PHRASE, and
|
|
# matching the verb alone matches every honest use of a perfectly ordinary word.
|
|
#
|
|
# A guard that cries wolf 141 times is worse than no guard: it gets an allowlist entry per sentence
|
|
# and then nobody reads it. So each pattern below carries the modal.
|
|
#
|
|
# ⚠ EVERY PATTERN ALLOWS AN ADVERB BETWEEN THE MODAL AND THE VERB, and that is not defensive
|
|
# padding — the decoy suite caught its absence. The first version read `can\s+(?:be\s+)?restor`
|
|
# and a planted "Your earlier backups can STILL be restored with your old recovery code" walked
|
|
# straight through it. One adverb. That is R-299 again, in English: a guard written for one surface
|
|
# form of a claim, and the claim wearing another.
|
|
_ADV = r"(?:\s+\w+ly|\s+still|\s+always|\s+then)?" # an optional adverb, e.g. "can STILL be"
|
|
RETRIEVAL_STEMS_EN = [
|
|
# can [still] [be] restored / recover / retrieve
|
|
r"\b(?:can|could|will\s+be\s+able\s+to|are\s+able\s+to|is\s+able\s+to)" + _ADV +
|
|
r"(?:\s+be)?" + _ADV + r"\s+(?:restor|recover|retriev|un-?seal|open)",
|
|
# can [still] get/bring <it> back
|
|
r"\b(?:can|could|will)" + _ADV + r"(?:\s+be\s+able\s+to)?" + _ADV +
|
|
r"\s+(?:get|bring|have)\s+\w+\s+back",
|
|
# the adjectives, which carry the claim on their own
|
|
r"\b(?:restorable|recoverable|retrievable)\b",
|
|
# "are [still] recoverable / restorable"
|
|
r"\b(?:are|is|remain|remains|stay|stays)" + _ADV + r"\s+(?:restor|recover|retriev)able",
|
|
]
|
|
|
|
# The retired names have no English twin, and that is a FACT rather than an omission: „Beállító kód",
|
|
# „Helyreállítási kód" and „Tulajdonosi jelmondat" are translated in the bundle (setup code, recovery
|
|
# code, owner passphrase) and the retired ones were never written in English at all — there is no
|
|
# English form of „Visszaállító kód" that has ever shipped. If one is ever coined, it belongs here.
|
|
RETIRED_NAMES_EN = {}
|
|
|
|
# ── The three secrets, so a reviewer can check a name against the THING ───────────────────────────
|
|
#
|
|
# Not consumed by any check — it is here because every argument about these names has had to be
|
|
# reconstructed from register rows, and the table is the argument.
|
|
THE_THREE_SECRETS = [
|
|
("three words", "takes control of the dashboard", "Beállító kód"),
|
|
("ten words", "opens the sealed off-site backups", "Helyreállítási kód"),
|
|
("five words", "proves the account owns the box being bound", "Tulajdonosi jelmondat"),
|
|
]
|