run-resource-claims: eleven parser and vocabulary gaps in the shipped recipes and helpers #256

Open
opened 2026-08-25 19:09:41 +00:00 by jbr870 · 3 comments
Owner

Spawned from finding F-PO-43-5-13 (in-scope-deferrable) on issue #43 during decision D-PO-43-5-7, at the round-1 sweep.

Original scope note: Indexed together because each is a one-to-three-line fix and they share no root beyond 'the shipped text meets an input its author did not picture'. doc_grep_folded is not wrap-safe for INDENTED continuation lines, so the wrap-safe helper has its own wrap bug. §7 has a fourth silent unusable-record state: DISPATCH entries with no claims lines pass the grep, extract nothing, exit 0. §7's key-quoting regex cannot parse a kebab-case project-named class, the naming style this repo uses everywhere. Near-miss port spellings ('4080 - 4089', en-dash, leading zeros) compare as literal names and read disjoint. §8 uses the word 'lane' four sections before §11 declares neither vocabulary uses the other's word. develop §3.1's remedy paraphrase drops reassignment, silently discarding the remedy that keeps wave concurrency. Disclosure consumption is unsequenced: no consumer step tells the driver to read a report for a disclosure when filling the RELEASE entry. extract_bash_block_containing is not fence-aware for 4-backtick wrappers, the exact trap CLAUDE.md's fence-tracker rule names. ended_by_offenders has a latent false positive on inline-code prose mentions. AC-14's uniqueness scan is line-scoped while its presence check is not, so a WRAPPED restatement in a consumer escapes — the third appearance of the wrapped-anchor failure on this feature. make_real_tree_copy copies the entire repo, which from the main checkout means every sibling worktree, twice per run.

Disposition rationale: [CR-43] Eleven separate parser and vocabulary gaps in the shipped recipes and helpers, sharing no root beyond "the text met an input its author did not picture". Substantial by inspection, and the recommender never folds substantial work into a round already carrying six blocking fixes. None is a false green or a safety inversion; each is a wrong answer on an input that does not occur in this repo today. Deferring them as one issue keeps them together, which is how they will actually get fixed — eleven separate issues would fragment a single afternoon's work into eleven re-entries. Resolved under the operator's explicit choice of round-2 strategy this session — presented three options (blockers-only, full round, reassess the design) and instructed to proceed with the first — so this follows the recommender rather than overriding it. The recommendation itself is disposition-recommend.sh's, computed from the finding's fix_cost, feature_value, adjacent_to_blocking and category.

This issue was deferred out of the parent feature's scope; it carries no PREQ yet. Run /dev:requirements --issue={new-number} to flesh it out before planning.

Spawned from finding `F-PO-43-5-13` (in-scope-deferrable) on issue #43 during decision D-PO-43-5-7, at the round-1 sweep. **Original scope note:** Indexed together because each is a one-to-three-line fix and they share no root beyond 'the shipped text meets an input its author did not picture'. doc_grep_folded is not wrap-safe for INDENTED continuation lines, so the wrap-safe helper has its own wrap bug. §7 has a fourth silent unusable-record state: DISPATCH entries with no claims lines pass the grep, extract nothing, exit 0. §7's key-quoting regex cannot parse a kebab-case project-named class, the naming style this repo uses everywhere. Near-miss port spellings ('4080 - 4089', en-dash, leading zeros) compare as literal names and read disjoint. §8 uses the word 'lane' four sections before §11 declares neither vocabulary uses the other's word. develop §3.1's remedy paraphrase drops reassignment, silently discarding the remedy that keeps wave concurrency. Disclosure consumption is unsequenced: no consumer step tells the driver to read a report for a disclosure when filling the RELEASE entry. extract_bash_block_containing is not fence-aware for 4-backtick wrappers, the exact trap CLAUDE.md's fence-tracker rule names. ended_by_offenders has a latent false positive on inline-code prose mentions. AC-14's uniqueness scan is line-scoped while its presence check is not, so a WRAPPED restatement in a consumer escapes — the third appearance of the wrapped-anchor failure on this feature. make_real_tree_copy copies the entire repo, which from the main checkout means every sibling worktree, twice per run. **Disposition rationale:** [CR-43] Eleven separate parser and vocabulary gaps in the shipped recipes and helpers, sharing no root beyond "the text met an input its author did not picture". Substantial by inspection, and the recommender never folds substantial work into a round already carrying six blocking fixes. None is a false green or a safety inversion; each is a wrong answer on an input that does not occur in this repo today. Deferring them as one issue keeps them together, which is how they will actually get fixed — eleven separate issues would fragment a single afternoon's work into eleven re-entries. Resolved under the operator's explicit choice of round-2 strategy this session — presented three options (blockers-only, full round, reassess the design) and instructed to proceed with the first — so this follows the recommender rather than overriding it. The recommendation itself is disposition-recommend.sh's, computed from the finding's fix_cost, feature_value, adjacent_to_blocking and category. This issue was deferred out of the parent feature's scope; it carries no PREQ yet. Run `/dev:requirements --issue={new-number}` to flesh it out before planning.
Author
Owner

Folded in from the round-3 QA sweep on issue #43 (Phase Outcome PO-43-7).

Measured by an executing adversarial reviewer, not inferred. Deferral rationales are on #43 as decision-resolution:v1 comments.


[code CR-60] §7 step 3's quoting sed corrupts a quoted identity containing a comma, producing invalid JSON.

Severity: medium

Measured: a claims line carrying external: ["gitea:host/repo issues 43 and 256, read-only, 3 calls"] — the exact identity shape the sweep's own RELEASE recorded — emerges as ["gitea:host/repo issues 43 and 256, "read-only", "3" calls"], which is invalid JSON. The bare-item-quoting regex fires inside an already-quoted string after each comma. Checked against #256's eleven listed gaps and it is not among them. A new concrete parser instance that belongs with that set.

Proposed action: Fold into #256.


[code CR-61] §4's port-range expansion is unbounded and its intersection quadratic, so one typo'd digit hangs the dispatch decision with no diagnostic.

Severity: medium

Measured scaling: 1000-port ranges intersect in 0.1s, 5000-port in 0.6s, '1024-65535' against a single port exceeds 30s, and '1-999999999' — one extra digit — satisfies the ^[0-9]+-[0-9]+$ regex, passes malformed_range (start is less than end) and hangs indefinitely with no output. Not producible in this repo, which declares no ports, so Medium rather than High. A width ceiling in malformed_range is the cheap fix.

Proposed action: Add a range-width ceiling to malformed_range.


Folded in from the round-3 QA sweep on issue #43 (Phase Outcome PO-43-7). Measured by an executing adversarial reviewer, not inferred. Deferral rationales are on #43 as `decision-resolution:v1` comments. --- ## [code CR-60] §7 step 3's quoting sed corrupts a quoted identity containing a comma, producing invalid JSON. **Severity:** medium Measured: a claims line carrying external: ["gitea:host/repo issues 43 and 256, read-only, 3 calls"] — the exact identity shape the sweep's own RELEASE recorded — emerges as ["gitea:host/repo issues 43 and 256, "read-only", "3" calls"], which is invalid JSON. The bare-item-quoting regex fires inside an already-quoted string after each comma. Checked against #256's eleven listed gaps and it is not among them. A new concrete parser instance that belongs with that set. **Proposed action:** Fold into #256. --- ## [code CR-61] §4's port-range expansion is unbounded and its intersection quadratic, so one typo'd digit hangs the dispatch decision with no diagnostic. **Severity:** medium Measured scaling: 1000-port ranges intersect in 0.1s, 5000-port in 0.6s, '1024-65535' against a single port exceeds 30s, and '1-999999999' — one extra digit — satisfies the ^[0-9]+-[0-9]+$ regex, passes malformed_range (start is less than end) and hangs indefinitely with no output. Not producible in this repo, which declares no ports, so Medium rather than High. A width ceiling in malformed_range is the cheap fix. **Proposed action:** Add a range-width ceiling to malformed_range. ---
Author
Owner

Folded in from the round-6 QA sweep on issue #43 (Phase Outcome PO-43-10, decision D-PO-43-10-3).

[code CR-82] §4 reads a whitespace-malformed port range as an ordinary identity and silently judges it disjoint.

Severity: medium

Measured: port ['4080 - 4089'] against ['4085'] produces no entry at all, i.e. dispatch concurrently, while the reversed range '4089-4080' correctly reads unknown. The compare-it-as-the-name-it-is rationale is right for database and external, but for port a value that is neither an integer string nor a well-formed range is near-certainly a typo, and the filter already special-cases malformed ranges — just not this shape. Permissive direction, one typo away from the documented spelling. Fits #256's parser set.

Proposed action: Fold into #256.

Deferred rather than fixed in round 7 for two reasons, both recorded on #43 as the decision resolution: this project declares no ports so the input cannot occur here, and this set is best fixed as a unit by someone holding the whole parser in their head rather than one branch at a time.

Folded in from the round-6 QA sweep on issue #43 (Phase Outcome PO-43-10, decision D-PO-43-10-3). ## [code CR-82] §4 reads a whitespace-malformed port range as an ordinary identity and silently judges it disjoint. **Severity:** medium Measured: port ['4080 - 4089'] against ['4085'] produces no entry at all, i.e. dispatch concurrently, while the reversed range '4089-4080' correctly reads unknown. The compare-it-as-the-name-it-is rationale is right for database and external, but for port a value that is neither an integer string nor a well-formed range is near-certainly a typo, and the filter already special-cases malformed ranges — just not this shape. Permissive direction, one typo away from the documented spelling. Fits #256's parser set. **Proposed action:** Fold into #256. Deferred rather than fixed in round 7 for two reasons, both recorded on #43 as the decision resolution: this project declares no ports so the input cannot occur here, and this set is best fixed as a unit by someone holding the whole parser in their head rather than one branch at a time.
Author
Owner

Folded in from the round-7 QA sweep on issue #43 (Phase Outcome PO-43-11, decision D-PO-43-11-4).

[code CR-89] Step 3b residual false negative: a quoted value containing a comma before the key text still satisfies the new [{,]-anchored regex.

Severity: low

Measured: overran_resources: {external: "shared cache, database: also touched", port: [], workers: 0} is genuinely missing the database key and the recipe prints no SPARSE line, because the comma inside the quoted value satisfies the anchor. Same class as CR-81 bullet 2, one comma deeper, and the reference journal's real external values do contain commas. Informational only — step 4 states a SPARSE hit never voids — which is why it is Low. Folds naturally into #256's parser set.

Proposed action: Fold into #256.

This is the fourth near-miss in the same regex family to land here, after CR-60, CR-61 and CR-82. Fixing them one at a time is what produced the fourth; the deferral rationale on #43 argues they should be fixed as a unit.

Folded in from the round-7 QA sweep on issue #43 (Phase Outcome PO-43-11, decision D-PO-43-11-4). ## [code CR-89] Step 3b residual false negative: a quoted value containing a comma before the key text still satisfies the new [{,]-anchored regex. **Severity:** low Measured: overran_resources: {external: "shared cache, database: also touched", port: [], workers: 0} is genuinely missing the database key and the recipe prints no SPARSE line, because the comma inside the quoted value satisfies the anchor. Same class as CR-81 bullet 2, one comma deeper, and the reference journal's real external values do contain commas. Informational only — step 4 states a SPARSE hit never voids — which is why it is Low. Folds naturally into #256's parser set. **Proposed action:** Fold into #256. This is the fourth near-miss in the same regex family to land here, after CR-60, CR-61 and CR-82. Fixing them one at a time is what produced the fourth; the deferral rationale on #43 argues they should be fixed as a unit.
Sign in to join this conversation.
No description provided.