triform/cargoless
Template
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix(verdict): require freshness on base_sha-matched acceptance (CGLS-9 defense-in-depth) #43

Open
triform-admin wants to merge 1 commit from agent/verdict-freshness-cgls9 into main
pull from: agent/verdict-freshness-cgls9
merge into: triform:main
Conversation 0 Commits 1 Files changed 1 +81 -20
triform-admin commented 2026-06-14 14:51:33 +00:00
Owner
Copy link

Narrows status_is_acceptable to require base_sha match AND freshness (published after our push), closing a stale-echo acceptance. Defense-in-depth for the CGLS-9 a8 residual false-green; the daemon-side 2s synthetic-settle race is the primary closer and is tracked separately. 25/25 verdict unit tests pass.

See tf-multiverse memory project_cgls9_a8_residual_false_green_2026_06_13 for full telemetry-pinned root cause.

Narrows status_is_acceptable to require base_sha match AND freshness (published after our push), closing a stale-echo acceptance. Defense-in-depth for the CGLS-9 a8 residual false-green; the daemon-side 2s synthetic-settle race is the primary closer and is tracked separately. 25/25 verdict unit tests pass. See tf-multiverse memory project_cgls9_a8_residual_false_green_2026_06_13 for full telemetry-pinned root cause.
fix(verdict): require freshness on base_sha-matched acceptance (CGLS-9 defense-in-depth)
Some checks failed
ci / rust-analyzer latency harness (S1 / AC#2) (push) Has been skipped
Details
ci / fmt (push) Failing after 2m20s
Details
ci / test (pull_request) Successful in 1m53s
Details
ci / clippy (push) Successful in 3m12s
Details
ci / rust-analyzer latency harness (S1 / AC#2) (pull_request) Has been skipped
Details
ci / fmt (pull_request) Failing after 1m3s
Details
ci / build (push) Successful in 3m57s
Details
ci / test (push) Successful in 3m55s
Details
ci / build (pull_request) Successful in 3m33s
Details
ci / clippy (pull_request) Successful in 1m13s
Details
2dcdf60a65 
status_is_acceptable accepted any daemon status whose base_sha matched the
client --base, regardless of freshness. A green published for the base
BEFORE our push — the central --server-root / foreign-worktree case where
the daemon cannot attribute our overlay and leaves a pre-existing base-green
standing — would match the SHA while having analyzed nothing of ours
(crates:[]). The await accepted it as our overlay's verdict.

Narrow the (Some,Some) arm to require base_sha match AND freshness
(published after our push). Mismatch still never accepts (A2 cross-branch
protection intact); unattributed still degrades to freshness. Removes the
documented idempotent-re-run fast-path (a genuine re-run now waits for one
fresh publication — seconds, paid rarely); soundness over the micro-opt for
a merge gate.

Defense-in-depth only: the deployed daemon mints a FRESH base-green per
push without analyzing foreign overlays (a 2s synthetic-settle race in
spawn_ra_native_settle), so this client fix cannot fully close the
false-green alone — the daemon-side settle fix is tracked separately. This
hardening still correctly rejects a genuinely stale echo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Some checks failed
ci / rust-analyzer latency harness (S1 / AC#2) (push) Has been skipped
Details
ci / fmt (push) Failing after 2m20s
Details
ci / test (pull_request) Successful in 1m53s
Details
ci / clippy (push) Successful in 3m12s
Details
ci / rust-analyzer latency harness (S1 / AC#2) (pull_request) Has been skipped
Details
ci / fmt (pull_request) Failing after 1m3s
Details
ci / build (push) Successful in 3m57s
Details
ci / test (push) Successful in 3m55s
Details
ci / build (pull_request) Successful in 3m33s
Details
ci / clippy (pull_request) Successful in 1m13s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin agent/verdict-freshness-cgls9:agent/verdict-freshness-cgls9
git switch agent/verdict-freshness-cgls9

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff agent/verdict-freshness-cgls9
git switch agent/verdict-freshness-cgls9
git rebase main
git switch main
git merge --ff-only agent/verdict-freshness-cgls9
git switch agent/verdict-freshness-cgls9
git rebase main
git switch main
git merge --no-ff agent/verdict-freshness-cgls9
git switch main
git merge --squash agent/verdict-freshness-cgls9
git switch main
git merge --ff-only agent/verdict-freshness-cgls9
git switch main
git merge agent/verdict-freshness-cgls9
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
triform/cargoless!43
No description provided.