SLP-766-01: head-evidence carries verdicts across semantic relocation of an unchanged-looking patch

Closed
  • Is something wrong?
#790 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@drevendev is already working on this.

Since Oct 21, 2026.

  • #801 by @drevendev — open

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
git, python, typescript
Domain
testing, tooling

Research direction

Start with scripts/head_evidence.py, especially normalize(), identity(), own_diff(), walk(), and render(), then read the continuity criteria in issue #765. Reproduce the alpha-to-beta relocation and base-merge cases using real Git fixtures in scripts/tests/test_head_evidence.py, alongside the benign merge and changed-byte controls. Done means all six acceptance criteria hold, the full scripts/tests suite passes, the four PR gates pass, and the repair receives independent review.

Written by the indexing model from the issue text.

Description

area:tooling priority:high qa status:needs-triage type:bug

Type: bug
Area: tooling
Priority: high

Goal

Prevent a MACHINE continuity certificate from carrying an independent verdict onto unreviewed content, while preserving legitimate unchanged-content base refreshes. This is the previously unposted SLOPSTER finding SLP-766-01, now verified through the full original module rather than a copied normalization algorithm. Severity: HIGH because the certificate is consumed by the acceptance process; no actual incorrect repository merge is alleged.

Evidence

Inspected master 58cbabf0ef795b0b13fab6342a41878843c8992a, scripts/head_evidence.py, Git blob c9c300abd12ac08d2eae58384d962e2e26b8467a.

Locations: normalize() lines 77–84 and identity() 87–89 remove the hunk location/function context and blob identities; own_diff() uses git diff -U0; walk() lines 133–156 follows the first parent solely while those identities agree. render() then says an earlier verdict stands for the new head.

Governing acceptance: Issue #765 criterion 2 requires: “On a head that carries new content, the comment says so and carries no earlier verdict forward.” Criterion 1 separately permits an unchanged-content base merge. The false-equivalence case below is not such a merge.

Minimal real-Git fixture, file src.ts:

function alpha() {
  return 0;
}
function beta() {
  return 0;
}

Commit A on a topic branch changes only alpha to return 1. Commit B restores alpha and changes only beta to return 1. Their actual files and Git diffs differ. For each head, invoke the repository's own_diff(head, base, cwd), then identity(diff). Both identities are 8afb9c4b5e1b2b88 in this fixture. Invoke walk(B, reader(base, cwd)): chain.carried is true and the rendered certificate claims a verdict naming A stands for B.

Expected: B is a content change and requires fresh judgement. Observed: B is certified as unchanged. This is a lossy equivalence relation, not a cryptographic hash collision.

The same failure was reproduced with a genuine two-parent merge: advance base independently, merge it into A's branch, and make the alpha-to-beta relocation part of that merge's resulting tree. The second parent is actually reachable from base, yet walk() still carries A. Merely checking the parent count or base ancestry is therefore insufficient.

Reviewer-local execution on 2026-10-18: full unmodified, blob-verified head_evidence.py; real disposable Git repositories; actual own_diff, identity, reader, walk, and render calls. 5 regressions: 2 passed, 3 failed. Failures: ordinary relocation identity, ordinary relocation verdict chain, semantic relocation inside a base merge. Passing controls: a benign base merge shifting line positions, and a changed added byte (return 2) correctly breaking continuity.

Execution boundary: unused forge-adapter imports were replaced with fail-on-use sentinels, with mergeability.CONTEXT supplied for module initialization. No tested Git/identity/chain function was replaced, and no remote mutation was performed. Full repository policy/runtime suites were not run locally.

Scope

Repair content-continuity proof and add regressions against the real module. A candidate approach is to compare a base merge's actual product tree with its independently computed automatic merge result, rejecting conflicts/unprovable continuity, and to allow ordinary commits only when they do not alter accepted content. This is a recommendation, not a mandated implementation.

Generated-table-only changes need a narrowly checked exception: preserve legitimate docs/spec/IMPLEMENTATION_STATUS.md regeneration with its existing content-validation gate, rather than accepting arbitrary generated-file changes. Continue executing only trusted-base tooling; examine branch commits as data.

Non-goals

No transfer of verdict ownership, no automatic approval or merge, no weakening of required checks, no disabling safe base updates, no changes to economic specification. Do not treat matching titles, filenames, hunk counts, parent counts, or this lossy hash alone as sufficient evidence of continuity.

Acceptance criteria

  1. Moving the same removed/added lines from alpha to beta breaks verdict/handoff continuity.
  2. The same relocation embedded in a real two-parent base merge also breaks continuity.
  3. A benign base merge which merely shifts unchanged PR lines still preserves continuity when current gates are green.
  4. Generated-table-only regeneration remains supported only with truthful validation of that generated content.
  5. A certificate for changed content explicitly requires a current independent judgement and does not render an inherited-verdict claim.
  6. Tests import the real module and use real Git fixtures, including both refusing cases and positive controls; all existing policy tests remain green.

Verification

Add the fixtures under scripts/tests/test_head_evidence.py, run python -m unittest discover -s scripts/tests, and run the four required PR gates on the repaired head. The unchanged implementation must fail the relocation regressions while passing the benign-merge and changed-byte controls. Obtain independent review of the repair; this Issue does not itself revoke or replace any existing exact-head verdict.

Deduplication: searched current Issues for head_evidence and diff identity, and read completed #765. #765 records the original feature/contract, not this reproducible semantic-relocation failure. No matching open defect Issue was found.

Dominant language
TypeScript
Stars
4
Forks
0
Avg merge
7h 23m
Merged PRs (30d)
110

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from drevendev/trade_simulation

All issues in drevendev/trade_simulation

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.