Skip to content

html tri-comparison: skip non-executable <script type=...> in the audit walk - #2493

Merged
squid-protocol merged 3 commits into
mainfrom
fix/html-audit-nonexec-script-type
Aug 30, 2026
Merged

html tri-comparison: skip non-executable <script type=...> in the audit walk#2493
squid-protocol merged 3 commits into
mainfrom
fix/html-audit-nonexec-script-type

Conversation

@squid-protocol

Copy link
Copy Markdown
Owner

Validates html against the tri-comparison ledger (tri-comparison-ledger-sweep skill). One comparison-tooling defect found and fixed; one minor engine over-anchor documented + filed; zero real GitGalaxy recall gaps.

The tooling defect (fixed here — closes #2492 part 1)

tests/tools/tree_sitter_accuracy_audit.py::_html_embedded_ts_funcs (also used by tri_comparison_gatherer.py) injected the JavaScript grammar into every <script> element, checking only for src= and never type=. In revealjs_decks/demo.html a <script type="text/template"> slide displaying sample React code contributed two phantom functions (Example@145, SecondExample@158) — GitGalaxy and ctags both correctly ignore them — counting as 2 recall misses against GitGalaxy (html func recall showed 94.9%).

Fix: skip a <script> whose type is present and not in _EXECUTABLE_SCRIPT_TYPES (mirrors the existing src= skip and the HTML spec's classic/module-script gate). Also covers the corpus's x-shader/* and math/tex blocks. Regression test: tests/tools/test_html_embedded_ts_funcs.py (7 cases).

Verification

Check Result
recall_audit.py html 2 → 0 misses
gather_language("html") name-diff, 54 files zero real GitGalaxy recall gaps
html ts-accuracy baseline real_functions 39 → 37; func recall 94.9% → 100%
tree_sitter_accuracy_audit --all --ci all 31 languages OK
crucible_check.py full_precision + zero_dependency both PASS (zero engine-output change)
audit_check.py ruff / mypy / dead-key / ast-accuracy all clear

Ledger

Docs

docs/language_status/html.md — new per-language coverage doc (§1–8 via the language-status skill; §9 tri-comparison capstone).

🤖 Generated with Claude Code

squid-protocol and others added 3 commits August 30, 2026 12:59
…it walk

Validates html against the tri-comparison ledger. Found one comparison-tooling
defect and one minor engine over-anchor; zero real GitGalaxy recall gaps.

tree_sitter_accuracy_audit._html_embedded_ts_funcs (shared by
tri_comparison_gatherer) injected the JavaScript grammar into every <script>
element, checking only for src= and never the type= attribute. In
revealjs_decks/demo.html a <script type="text/template"> slide DISPLAYING sample
React code contributed two phantom functions (Example@145, SecondExample@158)
that GitGalaxy and ctags both correctly ignore -- counting as 2 recall misses
against GitGalaxy (html func recall 94.9%).

Fix: _html_embedded_ts_funcs now skips a <script> whose type is present and not
in _EXECUTABLE_SCRIPT_TYPES (mirrors its existing src= skip and the HTML spec's
classic/module-script gate). Also covers the corpus's x-shader/* and math/tex
blocks. Regression test: tests/tools/test_html_embedded_ts_funcs.py (7 cases).

Verification:
- recall_audit.py html: 2 -> 0 misses; gather_language("html") name-diff over
  54 files confirms zero real GitGalaxy recall gaps.
- html ts-accuracy baseline re-blessed real_functions 39 -> 37; func recall
  94.9% -> 100%. tree_sitter_accuracy_audit --all --ci: all 31 languages OK.
  Summary table in language_standards.py regenerated (Html 94.9% -> 100.0%).
- crucible_check.py: full_precision + zero_dependency both PASS (zero
  engine-output change -- this is test tooling + a docstring table).
- audit_check.py (ruff/mypy/dead-key/ast-accuracy): all clear.

Ledger:
- html/function/existence/agree[tree_sitter]_vs[ctags,gitgalaxy] -> validated,
  no longer reproduces (the fix above).
- html/function/existence/agree[gitgalaxy]_vs[ctags,tree_sitter] -> re-validated
  with an accurate verdict: its stale @media verdict no longer matched its sole
  example (script@demo.html:142, a bare <script type="text/template"> tag
  GitGalaxy's func_start anchors as a function-analog). A minor over-anchor; the
  symmetric type= exclusion for html func_start is filed as #2492 part 2
  (deferred -- language_standards.py change needing its own differential scan).
- chart SVG + points_of_interest.md regenerated.

docs/language_status/html.md: new per-language coverage doc (sections 1-8 via
the language-status skill; section 9 tri-comparison capstone written here).

Closes part 1 of #2492.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTkRyd9CxYQx42EMBdVkGx
…c-script-type

# Conflicts:
#	docs/self_scan/tri_comparison_chart.svg
#	docs/self_scan/tri_comparison_ledger.json
#2491

Post-merge regen: picks up #2491's jcl manual-verification badges (376/376**,
118/118**) alongside this branch's html changes. Only html Func Found / Func
Precision cells and the summary tallies move vs. origin/main; jcl's badges and
every other language are unchanged. html ledger verdicts (both shapes validated)
preserved through the --ours conflict resolution.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTkRyd9CxYQx42EMBdVkGx
@github-actions

Copy link
Copy Markdown
Contributor

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab

@squid-protocol
squid-protocol merged commit 6c52744 into main Aug 30, 2026
30 checks passed
@squid-protocol
squid-protocol deleted the fix/html-audit-nonexec-script-type branch August 30, 2026 17:10
squid-protocol added a commit that referenced this pull request Aug 30, 2026
…pt type=...>` (#2496)

* fix(#2492): html func_start must not anchor a non-executable <script type=...>

Part 2 of #2492 (part 1, the audit-tool side, shipped in #2493).

A `<script>` whose `type` is anything other than a JS MIME type / `module` /
bare is an inert data block the browser never runs -- reveal.js
`text/template` slide samples, `x-shader/*` GLSL, `math/tex`. GitGalaxy's html
`func_start` (`<(script|style)...`) anchored a function-analog on those too; for
a block with no embedded code the detector recognises, the anchor was left with
the bare name `script`. In the crucible this was exactly one occurrence --
`script` @ revealjs_decks/demo.html:142 -- the sole reproducer of the ledger
shape `html/function/existence/agree[gitgalaxy]_vs[ctags,tree_sitter]`, and the
1 "extra" dragging html tree-sitter func precision to 97.4%.

Fix (two coordinated changes, one shared denylist):
- language_standards.py: new module-level `_HTML_NONEXECUTABLE_SCRIPT_TYPES`
  (the denylist complement of tree_sitter_accuracy_audit.py's
  `_EXECUTABLE_SCRIPT_TYPES` allowlist) + `HTML_NONEXECUTABLE_SCRIPT_TAG`.
  html `func_start` gains a Rule-15 negative lookahead over that type set --
  this gates the raw structural-signal count (matched against un-shielded
  source).
- detector.py: Mode B slicer (`_slice_by_braces`) re-applies
  `HTML_NONEXECUTABLE_SCRIPT_TAG` against the raw `code` for the named-function
  list, because `_build_brace_safe_stream` has blanked every quoted attribute
  value (incl. `type=`) out of the `safe_code` that `func_start` is matched
  against there -- so the lookahead alone can't fire for the named path.
  Keeps `struct_func_start` and `function_count` consistent.

Verification (full Differential Scan chain):
- Standalone regex: all KEEP (`<script>`, `type="module"`, `type="text/babel"`,
  `<style>`, `<script src=>` ...) still match; all SKIP (`text/template`,
  `x-shader/*`, `math/tex`, `application/ld+json`, case-insensitive, `type` not
  first attr) rejected. ReDoS smoke clean at n=20000.
- html extraction gauntlet +15 cases (12 regex, 3 detector-integration) +
  strict: 226 pass. test_detector.py + test_language_standards_strict.py: 172 pass.
- ruff / mypy / dead-key / ast-accuracy: all clear.
- crucible_check.py full ~80-repo corpus: 6 diffs BOTH modes, every one the
  demo.html:142 `script` removal or its direct ripple (that file's Structural
  Magnitude 0.04->0.05, the revealjs_decks group mass 0.18->0.19, the global
  html impact 1.50->1.51) -- zero unrelated files or languages.
- Both golden masters re-blessed (`update_golden_master.py --yes` per mode).
- html ts-accuracy baseline re-blessed: extra_functions 1->0, precision
  97.4%->100%. `--all --ci` green; summary table regenerated (Html 100/100).
- tri-comparison chart/ledger/points_of_interest regenerated: the
  `agree[gitgalaxy]_vs[ctags,tree_sitter]` shape no longer reproduces; html Func
  Precision is now a clean GitGalaxy/tree-sitter tie at 37/37 (the transient
  "tree-sitter leads" state from #2493 is closed).
- docs/language_status/html.md §7/§9 updated.

Closes #2492.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTkRyd9CxYQx42EMBdVkGx

* Regenerate tri-comparison ledger/points-of-interest after merging main (#2494, #2495)

Post-merge regen. Chart/ledger diff vs origin/main is scoped to html:
Func Found 38->37, Func Precision 37/38->37/37 (the demo.html:142 script
over-anchor removed by this branch), tree-sitter no longer sole precision
leader for html. html ledger verdicts preserved through the --ours resolution.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTkRyd9CxYQx42EMBdVkGx

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Non-executable <script type=...> blocks: audit walk over-counted (fixed), html func_start over-anchors (open)

1 participant