feat: bound review by a frozen failure model and a quantifier rule - #337
Merged
Conversation
Every spec now carries a Failure model section on both lanes: actors and deployments, invariants at stake, accepted failure classes with reasons, and classes covered elsewhere. The security threat model becomes its extension. The design review challenges each entry once; afterwards $quest names the section to the branch reviewer on a `failure model:` line of the review block, carried by a new optional $trial-loop input. $gauntlet grades reachability against the model: accepted classes are disclosed suppressions, triggers outside the named deployments are at most a note reported once, and a wrong entry is one finding against it. A universal claim with no closure is one finding against the quantifier, never an enumeration of its instances. $trial-loop cites a model entry to reject a finding in one line and treats a defensible finding against an entry as blocked. Records the decision as ADR 0057 and bumps the plugin to 4.7.0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Adversarial review had no stated answer to "what can go wrong here that matters" on a non-security change, so the reviewer supplied the worst case and a single "all" in a spec produced an open series of instance findings. This adds the referent and two bounding rules. Recorded as ADR 0057.
$spellcraftrequires aFailure modelsection in every spec on both lanes: actors and deployments, invariants at stake, accepted failure classes with reasons, and classes covered elsewhere. In the light lane it sits underScopeand counts against the caps. The threat model becomes its security extension. The self-review bounds every universal word before review, and the design-review brief challenges each entry once.$gauntletgrades reachability against the model. Accepted classes are disclosed suppressions, a trigger outside the named deployments is at most onemediumnote, and a wrong entry is one finding against it at the severity the evidence supports. A universal claim with no closure is one finding against the quantifier, never an enumeration of its instances.suppressionsentries carryadrorfailure_model.$trial-loopgains an optionalfailure_modelinput and afailure model:line in the transmitted block. It is not a ninth charter field. Rejection may cite a model entry in one line; a defensible finding against an entry isblocked; adding an accepted class mid-cycle is named as exclusion gaming.$questpasses the reviewed spec's section to branch review, ornoneon ano-specrun.Verification
just verifylocally: every gate passes excepttests/fixtures/forge/eval-fixtures-test.sh, which fails identically on cleanmainunder a UTF-8 locale and passes underLC_ALL=C. Filed as #336; not touched here. The eight suites ordered after it,actions-check, and the prek dry run were run separately and pass. The pre-push hook's full verify ran green underLC_ALL=C.Not in this PR
$detect-evil: its spec threat-model reconciliation is unchanged, and its suppressions remain ADR-only by its own contract.docs/workflow/specs/are not backfilled with a failure model; the section is required of specs written from this version on.