check-orientation: the pin leg passed on REVERSED doctrine — it read a string, not a polarity

[jobordu]

Closes #316's live half. Found in the 47-issue stale backlog; measured on origin/main 2026-09-08. TEAMLEAD (session 15b69750).

Both attacks #316 names, run

ATTACK A  delete ONE endorsed pin form, keep the other        → exit 0   ✅ ALREADY FIXED
ATTACK B  rewrite BOTH endorsed lines as
          "⛔ DEPRECATED — NEVER do this: <the form> … ✅ markers emit"
                                                              → exit 0   ⛔ STILL LIVE
          and the leg printed  ok  an ✅-marked pin form (either endorsed one)

⇒ The doctrine fully reversed and the required gate green. #316 said it in one line: "it is not measuring the doctrine; it is measuring the presence of one string."

⛔ And the predicate's own docstring claimed this was handled

It said a line reading ⛔ Never use: git archive … had passed a previous version and now would not — but the test was "✅" in line, and a counter-example carries both glyphs. ⇒ The fix was written against a weaker attack than the one filed.

Fixed — position, not presence

The negation is read in the text before the matched form, because that is what reverses it.

⚠ A ⛔ after the command is commentary on something else and must not disqualify a genuine endorsement. That is a control, not a nicety, and it is asserted.

Three states, all exercised

✅ doctrine intact                → exit 0
⛔ ATTACK B, both lines reversed  → exit 1,  GONE  an ✅-marked pin form
✅ ATTACK A, one form deleted     → exit 0   (no regression on the earlier fix)

⚠ The self-test needed a hoist, and my first control was a NameError

_endorsed_pin_line was nested inside check_pin_doctrine(), so the first version of these asserts raised NameError and returned rc 1 whether the code was broken or not.

I read that as "the control fires" until I looked at the output: broken rc 1, restored rc 1. A uniform result is not a measurement — which is this file's own subject.

⛔ Now it discriminates: replacing the positional test with a bare if m: gives

KNOWN-NEGATIVE FAILED (#316 ATTACK B): a NEGATED form must not count      rc=1

✅ python3 -O → rc 2, never 0.

Not addressed here

#316 §2, "why it landed anyway" — a refutation posted with gh issue comment on a PR creates a comment, not a review, so reviews=0 and the merge decision could not see it. That is a channel finding about a person's action, not a defect in this file. ⚠ It is also the finding my own merge-guard leg 3 advisory now makes visible on every unreviewed merge.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a1b79276-ba54-43ee-9fc8-03a88213752a

📥 Commits

Reviewing files that changed from the base of the PR and between 4141aa3 and d3db959.

📒 Files selected for processing (1)

• scripts/check-orientation.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sentinel-by-digital-frontier]

🛡️ Sentinel PR review

1 file(s) changed · 0 introduced by this diff (secrets+SAST) · dependencies unchanged — SCA/CVE not re-scanned. Advisory — the fail-closed gate is the post-merge pentest.

Findings — ranked by criticality

No issues found on the changed surface.

Scan summary

Category	Scope	Findings
Secrets	this diff	0
Static analysis	changed files	0
Dependencies + IaC	skipped (no manifest changed)	0
Known CVEs	skipped (no manifest changed)	0