[PR #318] [MERGED] test(bump-callers): assert the suite's own trigger covers every fleet `paths:` positive #320

New issue

Closed

opened 2026-10-26 22:38:27 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:38:27 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/318
Author: @mattmillerai
Created: 9/18/2026
Status: ✅ Merged
Merged: 9/19/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-15318-trigger-covers-fleet-positives

📝 Commits (3)

c1c86fb test(bump-callers): assert the suite's own trigger covers every fleet paths: positive
8c0c54e test(bump-callers): match the trigger-coverage probe the way Actions matches
f44200d Merge remote-tracking branch 'origin/main' into matt/be-15318-trigger-covers-fleet-positives

📊 Changes

2 files changed (+326 additions, -30 deletions)

View changed files

📝 .github/bump-callers/README.md (+9 -10)
📝 .github/bump-callers/tests/test_paths_contract.sh (+317 -20)

📄 Description

ELI-5

This repo's bump-*-callers.yml fleets each watch a few directories. A test
(test_paths_contract.sh) walks those directories looking for one specific
booby-trap: a !x/*_test.go exclusion behaves differently in a GitHub Actions
paths: filter than in a git diff pathspec the moment a matching file shows up
one directory down.

That measurement only runs when this suite runs. So it is only useful if the
suite's own trigger fires on the PR that plants the booby-trap. It does today —
test-bump-callers.yml watches .github/** and scripts/**, two whole trees —
but nothing asserted it, so the day a fleet starts watching something outside
those trees the measurement would quietly go blind and first speak up on some
unrelated later PR.

This adds that assertion, plus a fixture that proves it can actually fail.

What changed

test_paths_contract.sh

ALL_POSITIVES accumulates every fleet's positive paths: entry verbatim,
mirroring how ALL_EXEC_ENTRIES is accumulated. It is appended before any
of the per-fleet checks can continue out of the iteration — including the
has_preflight and empty-WATCHED guards, which are themselves the mid-edit
case: a fleet whose preflight inputs are mid-edit is still a fleet whose
surface the trigger has to cover. (compare_pathspecs still receives the
normalize_globed positives; the two consumers no longer share one reduced
form that suits neither.)
A second pass in the == this suite's trigger covers the paths it reads ==
block runs those positives through the same match as the existing WATCHED_EXEC
pass:
- ok: test-bump-callers.yml triggers on all 23 distinct fleet paths: positives
- or a bad naming the count, a 4-entry sample, and the fix ("add the tree to
  BOTH paths: lists in that workflow").
Zero collected positives is reported as vacuous, not clean — that state can
only mean every entrypoint failed to parse.
The match loop is extracted into uncovered_against_filter, used by both
passes, and it matches the way Actions matches rather than leaning on the
shell's glob (see Review round below):
- actions_glob_match translates a filter entry to an anchored ERE — ** → .*,
  * → [^/]*, ? → [^/], every other regex metacharacter escaped literal —
  so a single * stops at / the way an Actions filter does and bash's does not.
- coverage_probe decides what to match: an X/** entry names a TREE, and the
  property this pass claims is that a file DEEP inside it fires the trigger, so it
  probes a synthetic descendant. A literal-file entry probes itself, which is what
  the WATCHED_EXEC pass needs.
- The filter list is applied in order, last match wins, so a ! entry actually
  excludes and a later positive can re-include — Actions' own rule.
New == trigger-coverage self-test == section, in the style of pathspec_case /
guard_case — six cases, all driven through parse_push_paths, the same parser
that reads the real files:
- a filter of only .github/bump-callers/** vs a scripts/x/** fleet → uncovered;
- a depth-1 filter (scripts/*) vs a scripts/x/** fleet → uncovered
  (Actions' * stops at /);
- a fleet watching exactly a filter tree root (scripts/**) → covered;
- a filter carrying a ! exclusion over the fleet's surface → uncovered;
- the same two entries reversed, a later positive re-including → covered;
- the real filter against the real 13 entrypoints → covered.
cover_case guards a fixture whose FILTER parsed no patterns as vacuous, the
mirror of the existing guard on a fixture that parsed no positives — with an
empty filter every entry reports uncovered, so an uncovered case would
otherwise pass for the wrong reason.
Both live passes consume uncovered_against_filter's exit status (command
substitution, not process substitution): a helper that aborted previously
emitted no lines, left uncovered empty and reported the passing verdict.
Drive-by: an inverted comment on the pull_request/push list-identity check.
parse_push_paths is anchored to ^ push:, so it is the pull_request list
that could drift out from under these passes, not the push one.

.github/bump-callers/README.md — one sentence recording that the
measurement's usefulness rests on the trigger: test-bump-callers.yml runs on any
change under .github/** or scripts/** (#302), so the measurement fails the PR
that creates the divergence, and the contract test now asserts that filter
covers every fleet's positive paths: entry.

No bump-*-callers.yml is modified. No workflow file is modified.

Corpus swept

All 13 bump-*-callers.yml entrypoints, read as they ship:

	count
positive `paths:` entries	25 (23 distinct)
…covered by the current filter	23 / 23
negative (`!`) entries — not covered by this check	14 (11 distinct)
WATCHED_EXEC paths (existing pass, unchanged)	57 distinct

The 14 negatives are deliberately out of this assertion: an exclusion only ever
narrows a surface already listed as a positive, so covering the positive covers
it. They are named here because that is the half this PR does not measure.

Verification

bash .github/bump-callers/tests/test_paths_contract.sh → 147 passed, 0 failed
on bash 5.2.21, and 147 passed, 0 failed on bash 3.2.57 (run in a bash:3.2
container with the repo and its gitdir mounted and git installed into the
image — the suite's git ls-files probe needs a git binary as well as both
mounts; without it 10 fleets fail the tracked-file check identically on this
branch and on its parent, which is the environment, not the diff).
Each behavioural fix is pinned by a case that fails against the
implementation it replaced — checked by reverting each one in turn:
- bash-glob instead of the Actions-accurate ERE → a depth-1 filter does not cover a tree fleet reports covered, want uncovered;
- root-only probe instead of the descendant → that case plus a fleet watching exactly a filter tree root (uncovered, want covered, naming
  scripts/**) plus the exclusion case;
- first-match-wins ignoring ! → a ! exclusion in the filter uncovers the surface it removes reports covered, want uncovered;
- dropping the empty-filter guard → a want=uncovered case pointed at a
  paths:-less workflow reports ok instead of failing as vacuous;
- making the helper exit 9 mid-loop → both live passes now emit the new
  "aborted rather than answering" bad where they previously reported ok.
Negative direction, as before: delete '.github/**' + 'scripts/**' from
test-bump-callers.yml, leaving the three entries the filter carried before
#302 → the new message fires, naming the count and a 4-entry sample. The
workflow was restored afterwards; it is untouched in the diff.
shellcheck -x over the exact five files test-bump-callers.yml lists → clean
(SC2053 is no longer suppressed anywhere — the match is a regex now, not a glob).
Whole job run locally: test_bump_callers.sh 437/0, test_preflight.sh 445/0,
test_paths_contract.sh 147/0.
python3 .github/agents-md-integrity/check_agents_md.py --root . → passed
(2 pre-existing warnings, unrelated).
python3 .github/workflow-pins/check_workflow_pins.py → OK.

Review round

The panel raised six findings on the first revision, all on the same gap: the new
pass claimed a deep file under a watched surface fires this suite, but
measured the surface ROOT against the filter using bash's own glob. All six
are fixed in 8c0c54e; each thread carries the specific fix and the fixture that
pins it.

	finding	fix
🟡	bash's `` crosses `/`, an Actions filter's does not → a `scripts/` filter reported every surface covered (false green)	`actions_glob_match` + descendant `coverage_probe`
🟡	`!` entries loaded as independent positives, so an exclusion matched nothing (false green)	ordered application, last match wins
🟢	normalized positives vs `/` filter entries → a fleet on a filter tree root read uncovered (false red**, with a remediation that stays red)	`ALL_POSITIVES` verbatim + `coverage_probe`
🟢	`cover_case` did not guard an empty FILTER, so an `uncovered` fixture could pass for the wrong reason	mirror vacuity guard
🟢	the `ALL_POSITIVES` append sat below two guards its own comment claimed it sat above	moved to the `paths:` parse
🟢	process substitution discarded the helper's rc, so an abort read as a clean pass	command substitution, rc consumed

Nothing was deferred; no follow-up ticket is proposed.

Judgment calls

Extracting uncovered_against_filter instead of inlining a second copy of
the loop. The task described an inline second pass. Two hand-copied match
loops are free to drift, and — more importantly — an inline loop is not
drivable from a fixture, so the new self-test could not exist. That is the
same reason compare_pathspecs was extracted. The cost is that the diff
touches lines #302 added. The review round made this load-bearing rather than
merely tidy: all six findings were fixed in the one helper, and both passes
got them.
The vacuity guards — on zero collected positives, and (after review) on a
fixture whose filter parsed no patterns — are not in the task text. They cost
a few lines each and close the one failure mode a coverage check must not
have: reporting the passing verdict because it measured nothing.
The self-test's "real pair" case duplicates the live assertion. Kept
deliberately: without it the fixture only proves the helper can say
uncovered, and an implementation that says uncovered for everything would
pass it.
Reimplementing Actions' glob rather than keeping the documented
permissive-but-safe shortcut. The first revision matched with bash's glob and
argued the permissiveness was safe "for ** prefixes — the only shape used
here". That argument is true of today's filter and is exactly the kind that
stops being true silently, which is the failure this whole check exists to
prevent. actions_glob_match is ~15 lines and removes the caveat instead of
documenting it; it is deliberately limited to the three wildcards Actions'
filter syntax defines, and every other metacharacter is escaped literal.

Residual

The README paragraph this work was supposed to delete is not on main yet, so
this PR could not delete it. The plan behind this change had two parts, and one
of them assumed a base that does not exist yet:

The paragraph beginning One caveat on "the day it becomes true": the measurement runs when … — which describes the old three-entry filter and is
false now that #302 has landed — is added by PR #308, which is still
open at the time of writing. main does not contain it, so there was
nothing to remove. What this PR does instead is write the replacement
statement (the trigger + the new assertion) into the same paragraph on main.
Action needed when #308 lands: delete that caveat paragraph. Whichever of
#308 and this PR merges second will hit a conflict on those exact README lines
— resolve it by keeping #308's three "scope of the measurement" bullets and
this PR's trigger sentence, and dropping the caveat paragraph entirely. If #308
merges without that resolution, main carries both a paragraph saying the
measurement can miss the divergence PR and a sentence saying it cannot; the
first is the false one.
Consequently the acceptance item "README no longer claims the measurement can
miss the divergence PR" is satisfied on main as it stands but not
guaranteed after #308 merges, and that is the single piece of this work left
undone.

Unexercised artifacts.

PR #308's post-merge state. Everything here was built and verified against
main (f22ad8f), not against main + #308. The contract-test half does not
overlap #308's hunks (it adds a function above # --- the contract ---, a
self-test section, and a pass inside the trigger-coverage block; #308 edits the
fleet loop's exclusion branch and appends a guard fixture section), so no
conflict is expected there — but that is read off the two diffs, not measured
against a merged tree.
Basing on #308's branch instead was rejected: that branch predates #302 by
~5,000 lines of main, so a stacked PR would have shown six unrelated merged
PRs in its own diff, and the self_filter block this change extends does not
exist on it at all.

Capability-denial check. This diff adds no capability-denying path — no
"unsupported"/"unavailable" string, no throw, no test flipped to assert a
dead-end. The two new bad branches are test-failure diagnostics that name the
fix ("add the tree to BOTH paths: lists"), and both were driven to fire against
a real narrowed filter rather than only asserted in prose.

Provenance

Authored by: agent-work loop
Verified: test_paths_contract.sh 147 passed / 0 failed on bash 5.2.21 and on bash 3.2.57 (container with git installed; without a git binary 10 fleets fail the tracked-file probe identically on this branch and its parent); each of the six review fixes driven to fail against the implementation it replaced; narrowed-filter negative run carries the new message; test_bump_callers.sh 437/0; test_preflight.sh 445/0; shellcheck -x clean over the five files the CI job lists; check_agents_md.py --root . passed; check_workflow_pins.py OK
Deviations: the README deletion half is not done — the paragraph it targets is added by open PR #308 and is not on main; see ## Residual. The ## Corpus swept counts (25 entries / 23 distinct / 57 WATCHED_EXEC) were re-measured after the review round and are unchanged; the entries are now carried verbatim rather than normalize_globed, which did not alter the distinct count.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/318 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 9/18/2026 **Status:** ✅ Merged **Merged:** 9/19/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-15318-trigger-covers-fleet-positives` --- ### 📝 Commits (3) - [`c1c86fb`](https://github.com/Comfy-Org/github-workflows/commit/c1c86fb9e52da373bc47794a9adae07e6d8e47a7) test(bump-callers): assert the suite's own trigger covers every fleet `paths:` positive - [`8c0c54e`](https://github.com/Comfy-Org/github-workflows/commit/8c0c54e652aabef5ea8c1ff429f98e539decbd2c) test(bump-callers): match the trigger-coverage probe the way Actions matches - [`f44200d`](https://github.com/Comfy-Org/github-workflows/commit/f44200d48edd0dbb87f645e6d55a21dfd6ddff81) Merge remote-tracking branch 'origin/main' into matt/be-15318-trigger-covers-fleet-positives ### 📊 Changes **2 files changed** (+326 additions, -30 deletions) <details> <summary>View changed files</summary> 📝 `.github/bump-callers/README.md` (+9 -10) 📝 `.github/bump-callers/tests/test_paths_contract.sh` (+317 -20) </details> ### 📄 Description ## ELI-5 This repo's `bump-*-callers.yml` fleets each watch a few directories. A test (`test_paths_contract.sh`) walks those directories looking for one specific booby-trap: a `!x/*_test.go` exclusion behaves differently in a GitHub Actions `paths:` filter than in a `git diff` pathspec the moment a matching file shows up one directory down. That measurement only runs when this suite runs. So it is only useful if the suite's *own* trigger fires on the PR that plants the booby-trap. It does today — `test-bump-callers.yml` watches `.github/**` and `scripts/**`, two whole trees — but nothing asserted it, so the day a fleet starts watching something outside those trees the measurement would quietly go blind and first speak up on some unrelated later PR. This adds that assertion, plus a fixture that proves it can actually fail. ## What changed **`test_paths_contract.sh`** - `ALL_POSITIVES` accumulates every fleet's positive `paths:` entry **verbatim**, mirroring how `ALL_EXEC_ENTRIES` is accumulated. It is appended **before** any of the per-fleet checks can `continue` out of the iteration — including the `has_preflight` and empty-`WATCHED` guards, which are themselves the mid-edit case: a fleet whose preflight inputs are mid-edit is still a fleet whose surface the trigger has to cover. (`compare_pathspecs` still receives the `normalize_glob`ed `positives`; the two consumers no longer share one reduced form that suits neither.) - A second pass in the `== this suite's trigger covers the paths it reads ==` block runs those positives through the same match as the existing WATCHED_EXEC pass: - `ok: test-bump-callers.yml triggers on all 23 distinct fleet `paths:` positives` - or a `bad` naming the count, a 4-entry sample, and the fix ("add the tree to BOTH `paths:` lists in that workflow"). - Zero collected positives is reported as **vacuous**, not clean — that state can only mean every entrypoint failed to parse. - The match loop is extracted into `uncovered_against_filter`, used by **both** passes, and it matches **the way Actions matches** rather than leaning on the shell's glob (see *Review round* below): - `actions_glob_match` translates a filter entry to an anchored ERE — `**` → `.*`, `*` → `[^/]*`, `?` → `[^/]`, every other regex metacharacter escaped literal — so a single `*` stops at `/` the way an Actions filter does and bash's does not. - `coverage_probe` decides *what* to match: an `X/**` entry names a TREE, and the property this pass claims is that a file DEEP inside it fires the trigger, so it probes a synthetic descendant. A literal-file entry probes itself, which is what the WATCHED_EXEC pass needs. - The filter list is applied **in order, last match wins**, so a `!` entry actually excludes and a later positive can re-include — Actions' own rule. - New `== trigger-coverage self-test ==` section, in the style of `pathspec_case` / `guard_case` — six cases, all driven through `parse_push_paths`, the same parser that reads the real files: - a filter of only `.github/bump-callers/**` vs a `scripts/x/**` fleet → `uncovered`; - a **depth-1** filter (`scripts/*`) vs a `scripts/x/**` fleet → `uncovered` (Actions' `*` stops at `/`); - a fleet watching **exactly a filter tree root** (`scripts/**`) → `covered`; - a filter carrying a `!` **exclusion** over the fleet's surface → `uncovered`; - the same two entries **reversed**, a later positive re-including → `covered`; - the real filter against the real 13 entrypoints → `covered`. - `cover_case` guards a fixture whose FILTER parsed no patterns as vacuous, the mirror of the existing guard on a fixture that parsed no positives — with an empty filter every entry reports uncovered, so an `uncovered` case would otherwise pass for the wrong reason. - Both live passes consume `uncovered_against_filter`'s exit status (command substitution, not process substitution): a helper that aborted previously emitted no lines, left `uncovered` empty and reported the **passing** verdict. - Drive-by: an inverted comment on the `pull_request`/`push` list-identity check. `parse_push_paths` is anchored to `^ push:`, so it is the `pull_request` list that could drift out from under these passes, not the `push` one. **`.github/bump-callers/README.md`** — one sentence recording that the measurement's usefulness rests on the trigger: `test-bump-callers.yml` runs on any change under `.github/**` or `scripts/**` (#302), so the measurement fails the PR that *creates* the divergence, and the contract test now asserts that filter covers every fleet's positive `paths:` entry. No `bump-*-callers.yml` is modified. No workflow file is modified. ## Corpus swept All 13 `bump-*-callers.yml` entrypoints, read as they ship: | | count | | --- | --- | | positive `paths:` entries | 25 (23 distinct) | | …covered by the current filter | 23 / 23 | | negative (`!`) entries — **not** covered by this check | 14 (11 distinct) | | WATCHED_EXEC paths (existing pass, unchanged) | 57 distinct | The 14 negatives are deliberately out of this assertion: an exclusion only ever *narrows* a surface already listed as a positive, so covering the positive covers it. They are named here because that is the half this PR does not measure. ## Verification - `bash .github/bump-callers/tests/test_paths_contract.sh` → **147 passed, 0 failed** on bash 5.2.21, and **147 passed, 0 failed** on bash 3.2.57 (run in a `bash:3.2` container with the repo and its gitdir mounted and `git` installed into the image — the suite's `git ls-files` probe needs a git binary as well as both mounts; without it 10 fleets fail the tracked-file check identically on this branch and on its parent, which is the environment, not the diff). - **Each behavioural fix is pinned by a case that fails against the implementation it replaced** — checked by reverting each one in turn: - bash-glob instead of the Actions-accurate ERE → `a depth-1 filter does not cover a tree fleet` reports `covered`, want `uncovered`; - root-only probe instead of the descendant → that case **plus** `a fleet watching exactly a filter tree root` (`uncovered`, want `covered`, naming `scripts/**`) **plus** the exclusion case; - first-match-wins ignoring `!` → `a `!` exclusion in the filter uncovers the surface it removes` reports `covered`, want `uncovered`; - dropping the empty-filter guard → a `want=uncovered` case pointed at a `paths:`-less workflow reports `ok` instead of failing as vacuous; - making the helper `exit 9` mid-loop → both live passes now emit the new "aborted rather than answering" `bad` where they previously reported `ok`. - Negative direction, as before: delete `'.github/**'` + `'scripts/**'` from `test-bump-callers.yml`, leaving the three entries the filter carried before #302 → the new message fires, naming the count and a 4-entry sample. The workflow was restored afterwards; it is untouched in the diff. - `shellcheck -x` over the exact five files `test-bump-callers.yml` lists → clean (SC2053 is no longer suppressed anywhere — the match is a regex now, not a glob). - Whole job run locally: `test_bump_callers.sh` 437/0, `test_preflight.sh` 445/0, `test_paths_contract.sh` 147/0. - `python3 .github/agents-md-integrity/check_agents_md.py --root .` → passed (2 pre-existing warnings, unrelated). - `python3 .github/workflow-pins/check_workflow_pins.py` → OK. ## Review round The panel raised six findings on the first revision, all on the same gap: the new pass **claimed** a deep file under a watched surface fires this suite, but **measured** the surface ROOT against the filter using bash's own glob. All six are fixed in `8c0c54e`; each thread carries the specific fix and the fixture that pins it. | | finding | fix | | --- | --- | --- | | 🟡 | bash's `*` crosses `/`, an Actions filter's does not → a `scripts/*` filter reported every surface covered (false **green**) | `actions_glob_match` + descendant `coverage_probe` | | 🟡 | `!` entries loaded as independent positives, so an exclusion matched nothing (false **green**) | ordered application, last match wins | | 🟢 | normalized positives vs `/**` filter entries → a fleet on a filter tree root read uncovered (false **red**, with a remediation that stays red) | `ALL_POSITIVES` verbatim + `coverage_probe` | | 🟢 | `cover_case` did not guard an empty FILTER, so an `uncovered` fixture could pass for the wrong reason | mirror vacuity guard | | 🟢 | the `ALL_POSITIVES` append sat *below* two guards its own comment claimed it sat above | moved to the `paths:` parse | | 🟢 | process substitution discarded the helper's rc, so an abort read as a clean pass | command substitution, rc consumed | Nothing was deferred; no follow-up ticket is proposed. ## Judgment calls 1. **Extracting `uncovered_against_filter` instead of inlining a second copy of the loop.** The task described an inline second pass. Two hand-copied match loops are free to drift, and — more importantly — an inline loop is not drivable from a fixture, so the new self-test could not exist. That is the same reason `compare_pathspecs` was extracted. The cost is that the diff touches lines #302 added. The review round made this load-bearing rather than merely tidy: all six findings were fixed in the one helper, and both passes got them. 2. **The vacuity guards** — on zero collected positives, and (after review) on a fixture whose filter parsed no patterns — are not in the task text. They cost a few lines each and close the one failure mode a coverage check must not have: reporting the passing verdict because it measured nothing. 3. **The self-test's "real pair" case duplicates the live assertion.** Kept deliberately: without it the fixture only proves the helper can say `uncovered`, and an implementation that says `uncovered` for everything would pass it. 4. **Reimplementing Actions' glob rather than keeping the documented permissive-but-safe shortcut.** The first revision matched with bash's glob and argued the permissiveness was safe "for `**` prefixes — the only shape used here". That argument is true of today's filter and is exactly the kind that stops being true silently, which is the failure this whole check exists to prevent. `actions_glob_match` is ~15 lines and removes the caveat instead of documenting it; it is deliberately limited to the three wildcards Actions' filter syntax defines, and every other metacharacter is escaped literal. ## Residual **The README paragraph this work was supposed to delete is not on `main` yet, so this PR could not delete it.** The plan behind this change had two parts, and one of them assumed a base that does not exist yet: - The paragraph beginning `One caveat on "the day it becomes true": the measurement runs when …` — which describes the old three-entry filter and is false now that #302 has landed — is added by **PR #308**, which is still **open** at the time of writing. `main` does not contain it, so there was nothing to remove. What this PR does instead is write the *replacement* statement (the trigger + the new assertion) into the same paragraph on `main`. - **Action needed when #308 lands:** delete that caveat paragraph. Whichever of #308 and this PR merges second will hit a conflict on those exact README lines — resolve it by keeping #308's three "scope of the measurement" bullets and this PR's trigger sentence, and dropping the caveat paragraph entirely. If #308 merges *without* that resolution, `main` carries both a paragraph saying the measurement can miss the divergence PR and a sentence saying it cannot; the first is the false one. - Consequently the acceptance item "README no longer claims the measurement can miss the divergence PR" is **satisfied on `main` as it stands but not guaranteed after #308 merges**, and that is the single piece of this work left undone. **Unexercised artifacts.** - **PR #308's post-merge state.** Everything here was built and verified against `main` (`f22ad8f`), not against `main` + #308. The contract-test half does not overlap #308's hunks (it adds a function above `# --- the contract ---`, a self-test section, and a pass inside the trigger-coverage block; #308 edits the fleet loop's exclusion branch and appends a `guard` fixture section), so no conflict is expected there — but that is read off the two diffs, not measured against a merged tree. - Basing on #308's branch instead was rejected: that branch predates #302 by ~5,000 lines of `main`, so a stacked PR would have shown six unrelated merged PRs in its own diff, and the `self_filter` block this change extends does not exist on it at all. **Capability-denial check.** This diff adds no capability-denying path — no "unsupported"/"unavailable" string, no throw, no test flipped to assert a dead-end. The two new `bad` branches are test-failure diagnostics that name the fix ("add the tree to BOTH `paths:` lists"), and both were driven to fire against a real narrowed filter rather than only asserted in prose. ## Provenance - **Authored by:** agent-work loop - **Verified:** `test_paths_contract.sh` 147 passed / 0 failed on bash 5.2.21 and on bash 3.2.57 (container with `git` installed; without a git binary 10 fleets fail the tracked-file probe identically on this branch and its parent); each of the six review fixes driven to fail against the implementation it replaced; narrowed-filter negative run carries the new message; `test_bump_callers.sh` 437/0; `test_preflight.sh` 445/0; `shellcheck -x` clean over the five files the CI job lists; `check_agents_md.py --root .` passed; `check_workflow_pins.py` OK - **Deviations:** the README *deletion* half is not done — the paragraph it targets is added by open PR #308 and is not on `main`; see `## Residual`. The `## Corpus swept` counts (25 entries / 23 distinct / 57 WATCHED_EXEC) were re-measured after the review round and are unchanged; the entries are now carried verbatim rather than `normalize_glob`ed, which did not alter the distinct count. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:38:27 +00:00