story-039: Every configurable value is proven configurable

[jerodw]

Thirteen keys are read out of .harness/config.yaml and nothing established that any of them was obeyed. A value moved into configuration and then hardcoded to the same literal behaves identically in this repository, so the suite could not tell the two apart.

What changed

The key set is declared. schemas/harness-config.schema.json, in the manifest, with declared_config_keys as its only reader. Until now base_branch and clean_clone_python were discoverable only by grepping for config.get(.

Every key has a proof that sets it to a value the harness would never pick.

test_command: "xyzzy-runner --all"       clean_clone_python: "/xyzzy/bin/interpreter"
branch_prefix: "xyzzy-branch/"           permission_mode: "xyzzyPrompt"
stories_dir: ".harness/xyzzy-stories"    workflow: "xyzzy-workflow"

That is the whole mechanism. A fixture that set branch_prefix: story/ would prove nothing, and the reason today's coupling was invisible is that the hardcoded literal and the configured value agreed.

Coverage is set equality in both directions, with a control for each:

test_every_declared_key_has_a_proof_and_every_proof_names_a_declared_key
test_the_coverage_comparison_reports_a_declared_key_with_no_proof
test_the_coverage_comparison_reports_a_proof_naming_an_undeclared_key
test_every_proof_names_a_function_this_module_actually_defines
test_the_keys_the_harness_reads_and_the_keys_the_schema_declares_are_equal

The fourth was not asked for and is the one that closes the obvious hole: a proof naming a function that does not exist would otherwise satisfy the completeness check vacuously.

It found a tie on its first run

Varying both interpreter keys at once shows the clean-clone path building /xyzzy/bin/interpreter --all: the configured test command's leading word is discarded and the configured interpreter substituted for it, so the check does not run the command the target configured. That substitution is only correct if the leading word is known to be a Python interpreter — which is the assumption the-interpreter-is-not-assumed-to-be-python exists to remove.

Recorded rather than fixed, as the request asked. test_test_command_is_the_command_the_clean_clone_path_builds asserts what is true today, and the finding was written into that request, correcting a "not in scope" line that had assumed test_command reached the check intact.

Verification

• 2196 passed, 83 written; verification passed on the first iteration, no retries; clean-clone green with the story committed
• Every proof demonstrated red by mutation, so a key that stopped being read fails

One caveat the verifier logged

The mutation control for allowed_tools rewrites both call sites at once, so it demonstrates red when both stop reading the key rather than when either does alone. The verifier checked whether that weakens the proof and concluded it does not: the proof asserts the runner argument and the rendered prompt separately, so a single hardcoded site still fails exactly one of the two assertions.

🤖 Generated with Claude Code