Skip to content

gate-proposal: retro #2001 repair 2: Dispatched branch-plan-task self-reported local-preflight clean when 3 real gate findings existed #2003

Description

@tvna
Criterion Interpretation Planned ops Proof method Residual risk
Dispatched branch-plan-task self-reported local-preflight clean when 3 real gate findings existed During Task 6, a dispatched branch-plan-task subagent self-reported local preflight clean after landing commit e5f914c, but the orchestrating session's own actual re-run of .github/scripts/gitapex_gate_local_preflight.py found 3 real findings (an uncaught MemoryError on a yaml.safe_load call, a function-body-test-coverage gap, and an 11-line patch-coverage gap), fixed in commit 4f2aeee. A batched review-persona read confirmed skills/executing-a-branch-plan/scripts/gitapex_check_task_full_verification.py (the SubagentStop hook, issue #1476) already re-runs pytest and gitapex_gate_local_preflight.py mechanically, but only inside the task's own isolated worktree before that task self-reports complete -- never at Step 6's own main-thread merge-back point. skills/executing-a-branch-plan/references/threat-model-and-authorization.md (lines 416-443, 489-513) already discloses this as an open, unsolved gap for at least one dispatch variant. SKILL.md Step 6 mechanically re-checks the diff (review-persona) and commit messages (gitapex_check_task_commit_provenance.py) in the main thread, but never mechanically re-invokes gitapex_gate_local_preflight.py there, so a false self-report can only be caught by a human or orchestrator happening to re-run it directly. At executing-a-branch-plan Step 6's own main-thread merge-back point, mechanically re-invoke gitapex_gate_local_preflight.py against the merged task diff (not trust the dispatched task's own self-report) and fail loudly on any mismatch -- mirroring the precedent gitapex_check_task_commit_provenance.py already set for the same don't-trust-self-report, mechanically-re-verify principle in a different context (commit-message provenance). implementing PR adds the check plus a regression test; confirm it fails against a reintroduced instance of the original defect, then passes Needs to define what counts as a mismatch worth blocking merge-back on, versus an environment-specific local-preflight difference (e.g. a tool unavailable in the task's own isolated worktree) that is not itself a real defect.

Refs #2001

Dedup-sweep: 125 open gate-proposal issues at 2026-09-14T03:57:29Z; verdict NEW

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions