fix(cnpg-drill): refuse a drill manifest the archive trap cannot read #151

Merged

binjovi-bot merged 1 commit from fix/drill-trap-fail-closed into trunk

2026-09-01 19:37:07 +00:00

sean commented

2026-09-01 18:17:59 +00:00

Owner

assert_no_archive_destination is the only assertion standing between a restore drill and the production archive lineage. A drill cluster that archives writes into that lineage on a forked timeline and corrupts it.

It failed open:

body="$(grep -v '^[[:space:]]*#' "$manifest" || true)"

grep reports two different things through that one || true. Exit 1 means no lines survived — a real answer, since a manifest of nothing but comments declares no archive destination. Exit 2 or higher means grep never read the file. Both landed on the same branch, so an unreadable manifest produced an empty body, matched no pattern, and passed the trap.

The function's own comment claimed the opposite: "Fails closed: any occurrence at all, including one it cannot interpret, is a refusal."

Demonstrated before the fix:

$ assert_no_archive_destination /nonexistent/manifest.yaml
ACCEPTED an unreadable manifest  <-- FAIL-OPEN

Red: the trap accepted a path that was never written.
Green: statuses above 1 refuse; a comment-only manifest still passes.

Found while diagnosing seanfarm gate run seanfarm-fb74d162d05b-..., which failed this guard on the space before the colon case while the same commit passed locally, and while trunk passed the identical test nine minutes earlier. I confirmed the trap regex itself is sound under GNU grep 3.11 (all spellings match), so the regex is not the defect. A transient read of the case file is consistent with the flake — and either way an unread manifest must never count as a clean one.

https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

`assert_no_archive_destination` is the only assertion standing between a restore drill and the **production archive lineage**. A drill cluster that archives writes into that lineage on a forked timeline and corrupts it. It failed **open**: ```bash body="$(grep -v '^[[:space:]]*#' "$manifest" || true)" ``` grep reports two different things through that one `|| true`. Exit 1 means no lines survived — a real answer, since a manifest of nothing but comments declares no archive destination. Exit 2 or higher means grep never read the file. Both landed on the same branch, so an unreadable manifest produced an empty body, matched no pattern, and passed the trap. The function's own comment claimed the opposite: *"Fails closed: any occurrence at all, including one it cannot interpret, is a refusal."* Demonstrated before the fix: ``` $ assert_no_archive_destination /nonexistent/manifest.yaml ACCEPTED an unreadable manifest <-- FAIL-OPEN ``` **Red:** the trap accepted a path that was never written. **Green:** statuses above 1 refuse; a comment-only manifest still passes. Found while diagnosing seanfarm gate run `seanfarm-fb74d162d05b-...`, which failed this guard on the `space before the colon` case while the same commit passed locally, and while trunk passed the identical test nine minutes earlier. I confirmed the trap regex itself is sound under GNU grep 3.11 (all spellings match), so the regex is not the defect. A transient read of the case file is consistent with the flake — and either way an unread manifest must never count as a clean one. https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

sean added 1 commit

2026-09-01 18:18:00 +00:00

fix(cnpg-drill): refuse a drill manifest the archive trap cannot read

binjovi/ci Binjovi completed the frozen plan

Details

1ed6ff8914

assert_no_archive_destination is the only assertion standing between a restore
drill and the PRODUCTION archive lineage: a drill cluster that archives writes
into that lineage on a forked timeline and corrupts it.

The assertion failed OPEN. It stripped comments with

    body="$(grep -v '^[[:space:]]*#' "$manifest" || true)"

and grep reports two different things through that one `|| true`. Exit 1 means
no lines survived, which is a real answer: a manifest of nothing but comments
declares no archive destination. Exit 2 or higher means grep never read the
file. Both landed on the same branch, so an unreadable manifest produced an
empty body, matched no pattern, and passed the trap. The function's own comment
claimed the opposite: "Fails closed: any occurrence at all, including one it
cannot interpret, is a refusal."

Red: the trap accepted a path that was never written.
Green: statuses above 1 refuse, and a comment-only manifest still passes.

Found while diagnosing a seanfarm gate run that failed this guard on one case
and passed it locally on the same commit. A transient read of the case file is
consistent with that, and either way an unread manifest must never count as a
clean one.

Claude-Session: https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5