Skip to content

fix(ci): prevent product publisher bytecode from dirtying evidence - #175

Merged
ruvnet merged 1 commit into
mainfrom
fix/product-publisher-clean-evidence
Oct 12, 2026
Merged

ruvnet merged 1 commit into
mainfrom
fix/product-publisher-clean-evidence

Conversation

@ruvnet

@ruvnet ruvnet commented Oct 11, 2026 •

Copy link
Copy Markdown
Owner

Fix

Run the product-publisher boundary test with Python's -B flag so importing the publisher does not write bytecode into the source checkout.

PR #173 introduced this new test without the flag already added to the older publisher test in #171. The untracked bytecode makes the clean-source evidence gate correctly return INCONCLUSIVE.

Reproduction

On a clean checkout of 074dcb0058a6ce56383e6cb555f4bb33b7c2257e:

  • node --test scripts/factory-product-publish.test.mjs passes, but leaves scripts/__pycache__/factory-product-publish.cpython-312.pyc untracked.
  • From a fresh clean state, node scripts/ci-software-evidence.mjs exits 1 at the source ACCEPT assertion. Its evidence records source dirty=true and reason=uncommitted-source.
  • This matches the failing main CI job.

Validation

Locally reproduced on Node 24.19.0, Python 3.12.14, npm 11.9.0:

  • Targeted publisher test: 1 passed.
  • The unchanged full software-evidence wrapper passes with this one-line change committed in an isolated checkout; exit 0 and clean git status before and after.
  • Repository checks, simulation and source gates: ACCEPT.
  • Dependencies, licenses, benchmark claims and physical release: INCONCLUSIVE.
  • Evidence integrity: PASS / ACCEPT; hardwareActuation=false; deployment=blocked.

No source-gate, ignore-file, publication-policy or release changes. This remains a draft pending review.

Hosted CI

Verified October 11, 2026 for head f65395936288a9852938216262b65a7ce6e08259 (GitHub PR merge revision 9feca0e42e264553773079e0fce91eccc973323e):

  • CI: all six jobs passed, including software-evidence, Node 22/24, dependency audit/security and no-optional-deps.
  • Software-evidence job: source=ACCEPT, reason=clean-commit; all intentional INCONCLUSIVE gates preserved. Synthetic evidence artifact uploaded.
  • CodeQL and human-merge policy guard: passed.

The exact remote head also passed the unchanged full wrapper locally with clean git status.

ruvnet pushed a commit that referenced this pull request Oct 12, 2026
Ported from open PR #175 — this test's python3 -c invocation was the
one remaining source of scripts/__pycache__/*.pyc left uncommitted
after npm test, which the software-evidence CI gate's mission.mjs
reads as a dirty working tree and misclassifies the 'source' gate as
INCONCLUSIVE instead of ACCEPT.

Reproduced the failure identically on main@074dcb0 before this PR's
own changes (git worktree at the base commit) — not caused by this
PR's candidate. Confirmed fixed: npm test clean, git status clean
after the affected test runs individually and via the full suite.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Ds3v3vNof9VFVrCFZ6HFEy
@ruvnet
ruvnet marked this pull request as ready for review October 12, 2026 15:40
@ruvnet
ruvnet merged commit 2f8dff1 into main Oct 12, 2026
11 checks passed
ruvnet added a commit that referenced this pull request Oct 12, 2026
… INCONCLUSIVE (issue #176) (#177)

* evaluation-adapters: harness-optimizer's zero-surface patch masked as INCONCLUSIVE (issue #176)

evaluateHarnessCandidate()'s hardReject keyword list omitted
'no declared harness surface', so a structurally invalid patch (zero
declared harness surfaces) that also lacked holdout evidence fell through
to the inconclusive branch instead of hard-rejecting, misreporting
INCONCLUSIVE for a patch that is invalid regardless of evidence.

Added the missing keyword plus regression tests covering the exact
combination, the zero-surface+holdout case (unaffected, already worked),
and the non-empty-surface+no-holdout case (unaffected regression check).

npm test 1001->1004 (+3 vitest, 0 regressions), lint/typecheck clean.
Independent critic: CLEAR, one disclosed non-blocking note (an inaccurate
rationale in the first-draft code comment about why duplicate-surfaces
doesn't share this bug), corrected same session.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Ds3v3vNof9VFVrCFZ6HFEy

* docs(dream): record 2026-10-12 evaluation-adapters ledger row

Issue #176, PR #177.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Ds3v3vNof9VFVrCFZ6HFEy

* fix(ci): pass -B to python3 in factory-product-publish.test.mjs

Ported from open PR #175 — this test's python3 -c invocation was the
one remaining source of scripts/__pycache__/*.pyc left uncommitted
after npm test, which the software-evidence CI gate's mission.mjs
reads as a dirty working tree and misclassifies the 'source' gate as
INCONCLUSIVE instead of ACCEPT.

Reproduced the failure identically on main@074dcb0 before this PR's
own changes (git worktree at the base commit) — not caused by this
PR's candidate. Confirmed fixed: npm test clean, git status clean
after the affected test runs individually and via the full suite.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Ds3v3vNof9VFVrCFZ6HFEy

---------

Co-authored-by: Claude <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant