Repository navigation
Finish structural CI gate coverage - #5
Merged
Merged
Conversation
Each of these reported nothing and was read as finding nothing. The CI acceptance test is called "CI covers platform, browser, and non-publishing provenance gates" and asserted exactly one gate's invocation. Deleting `npm run check` from the workflow left it green. The gate roster is derived from the gate:* script keys now, the argument-forwarding entry point is excluded by the structural property that it ends in `--` rather than by name, and the excluded set is pinned so a real gate that starts forwarding arguments fails instead of quietly dropping out. The workflow reader throws on anchors, aliases, tags and flow collections rather than misreading them — a reader that guesses is the same failure one layer down. The runtime-boundary gate scraped exports with two regexes under a comment claiming nothing else enforced this. It could not see `export var` or `export function*`, and the second is this repository's own house style. It reads the export grammar off a token scan now, and every form it cannot read fails the gate instead of passing as a module with no exports. It agrees with the old regexes on all 46 real surfaces, so nothing was escaping today. Two adjacent holes in that gate mattered more than the regex. It identified a surface by name plus byte length, and padding Desktop's velar/fs to Node's exact length made the old key drop a surface silently — 35 where there are 36 — and pass green over a planted leak. And it skipped ten interface-less module sources with a bare continue. The wave's first rule for those was that internal modules may export only __velar names; that produced 77 failures because the rule is false, and it was discarded rather than forced. What replaced it is true: those sources sit outside the checked namespace, so each is accounted for against the compiler's own declared internal-module identities, in both directions. The same gate printed a count of runtime boundary operations that counted rows in a Markdown table, bound to nothing — appending a row raised it. Of those 77 rows, 73 name their proof in prose that resolves to no artifact and 50 are cited nowhere else in the repository, so binding them is a rewrite of the ledger rather than a repair of the gate. The number is gone instead of dressed up, and a test now asserts every number the summary prints is one the gate computed. Release sentinels are derived from the build roster, cross-checked by a second independent route so that replacing the derivation with a list fails loudly. The fifth site is the one nobody would have looked for: two tracked source files carried literal NUL bytes, so grep classified them as binary and returned nothing from them. One is the 131 KB boundary gate itself. A tool reporting nothing reads exactly like a tool finding nothing, which is how a file quietly stops being reviewed. The bytes are escapes now, with a test that decides text-ness without reference to the byte under test, because deciding it the way grep does would make the assertion vacuous. All four gates green: check=0, test=0 (1465/1465), test:packages=0, test:browser=0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…e wrong reason
I told the wave to derive this list as every Web interface minus velar/web-test
and minus velar/look, on the ground that look is a syntax feature with no
importable value surface. The wave verified that and refused to build on it,
which was the right call: velar/look publishes 37 exports, the charter itself
writes `import {alpha, border, rgb, spacing} from "velar/look"`, and the
repository's own web-capabilities fixture already counts it as public. The old
hand-written nine was not a definition of "browser application module" — it was
an omission, and my reasoning was an explanation invented for it after the
fact.
So the roster is every interface the extension publishes minus one, and the one
subtraction is the compiler's own BROWSER_TEST_MODULE constant rather than a
name matched by spelling. It earns the exclusion: application source that
imports velar/web-test is refused outright, because it only has a runtime under
`velar test --browser`, so the generated browser test exercises it one layer
below where it actually works.
Each module is probed with its first function export rather than its first
export. A type name would prove the interface parsed; a function proves the
installed package serves the module.
The documentation sentence had the same undercount and now states the rule
instead of a number, since the number is derived.
test:packages=0, check=0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation