Distillation

Date: Sep 9, 2026

• 🔴 (03:32) CLI output-safety audit task ses_f7be2a77effeiZn6JMXOS7LZqg completed with DO-NOT-MERGE, reporting 5 MUST-FIX defects and 1 CONCERN in src/institution_lab/governance_adjudication.py; no files were edited and no prohibited records or reviewer scopes were inspected.
• 🔴 (03:32) MUST-FIX 1 — output-path TOCTOU: path identity is checked only once at src/institution_lab/governance_adjudication.py:828-841 and :906, while _atomic_write re-resolves the mutable parent for mkdir, mkstemp, and os.replace at :844-852. A synthetic probe retargeted an output-parent symlink after validation; main() returned successfully and replaced --adjudication with an open summary.
• 🔴 (03:32) A second output-path TOCTOU probe made both outputs alias; main() returned successfully while --summary-json contained Markdown instead of JSON.
• 🔴 (03:32) Required TOCTOU regressions: retarget a parent symlink during the first input callback and assert nonzero exit, unchanged input bytes, distinct outputs, and valid closed summaries; also retarget after temporary-file creation to test the rename boundary.
• 🔴 (03:32) MUST-FIX 2 — stale outputs survive early failures: _validate_output_paths executes outside the protected block at src/institution_lab/governance_adjudication.py:906-907, the handler catches only Exception at :932, and prior summaries are not invalidated before fallible work.
• 🔴 (03:32) An actual subprocess with aliased outputs exited 1 but retained the prior JSON gate as open; a forced KeyboardInterrupt during the first read left both prior open summaries unchanged.
• 🔴 (03:32) Existing alias tests at tests/test_governance_adjudication.py:813-845 check rejection and input preservation but never check stale outputs.
• 🔴 (03:32) Required stale-output regression: seed both outputs with open summaries, then parameterize path-validation failures, OSError, KeyboardInterrupt, and SystemExit; after every nonzero invocation, each output must be absent or unambiguously closed without modifying an aliased input.
• 🔴 (03:32) MUST-FIX 3 — the JSON and Markdown summaries lack atomic publication or rollback: normal writes at src/institution_lab/governance_adjudication.py:938-940 and failure writes at :878-879 are sequential; normal writes are outside the exception handler; no lock, transaction, generation identifier, or rollback prevents split or interleaved generations.
• 🔴 (03:32) A forced second-write failure after valid processing raised OSError while JSON remained open and Markdown retained an old open summary. With malformed input, a forced Markdown failure left JSON closed and Markdown open, while the write error displaced the original top-level exception. Concurrent invocations can interleave generations.
• 🔴 (03:32) Required publication regressions: force failures at JSON serialization, Markdown rendering, and each atomic write in both success and failure paths; every nonzero result must leave no open artifact and preserve the original exception. Add a barrier-driven two-invocation test requiring one coherent generation.
• 🔴 (03:32) MUST-FIX 4 — failure Markdown allows forged gate declarations because _write_failure_reports interpolates str(error) without escaping at src/institution_lab/governance_adjudication.py:859-875. A multiline exception produced one genuine closed declaration plus an injected Canonicalization gate: **open** declaration and forged heading; JSON remained safely closed.
• 🔴 (03:32) Required Markdown-injection regression: raise an exception containing newlines, Markdown syntax, HTML, and an open-gate declaration; require exactly one gate declaration—closed—and render the message as escaped literal text.
• 🔴 (03:32) MUST-FIX 5 — _atomic_write is not crash-durable: it fsyncs the temporary file at src/institution_lab/governance_adjudication.py:850-851 and renames at :852, but never fsyncs the parent directory. Instrumentation observed only fsync:file, then replace, so a crash can restore the old directory entry, including an old open summary.
• 🔴 (03:32) Required durability regression: record filesystem-call order and require file fsync, replacement through a bound directory descriptor, then parent-directory fsync.
• 🔴 (03:32) CONCERN — validation failures disappear from Markdown: render_markdown accepts no validation errors at src/institution_lab/governance_adjudication.py:779, while main adds errors only to JSON at :935-940. A probe returned closed Markdown without the supplied schema error while JSON contained it.
• 🔴 (03:32) Required validation-report parity regression: force a collected validation error and require both summaries to render the same escaped error while returning nonzero.
• 🔴 (03:32) CLI audit confirmed stable input/output aliases through direct paths, symlinks, and hard links are rejected at src/institution_lab/governance_adjudication.py:828-841; existing tests cover all 8 inputs at tests/test_governance_adjudication.py:800-833.
• 🔴 (03:32) Ad hoc probes confirmed stable output/output symlink and hard-link aliases are rejected, although the committed test at tests/test_governance_adjudication.py:836-845 covers only the direct case.
• 🔴 (03:32) A single _atomic_write provides process-level old-or-new replacement and removes its temporary file when os.replace fails.
• 🔴 (03:32) With writable outputs, malformed adjudication JSON exited with code 1 and replaced both prior open summaries with closed reports.
• 🔴 (03:32) CLI-focused verification command uv run pytest -p no:cacheprovider tests/test_governance_adjudication.py -k 'cli' passed all 27 selected tests.
• 🔴 (03:32) Reviewed file hashes were governance_adjudication.py: c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5; test_governance_adjudication.py: abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5.
• 🟡 (03:32) Assistant initially planned deterministic fail-first regressions for stale outputs, path retargeting, two-file publication failure, injected Markdown, and directory durability, followed by hardening limited to the completed CLI scope.
• 🔴 (03:32) Work tracker marked “Harden CLI output publication and failure safety” as in_progress. Pending high-priority work remained: integrate the remaining 7 Terraform source adjudications; assemble the exact 40-record adjudication envelope with the gate closed for unresolved records; run targeted and full verification; obtain independent correctness/security reviews and address findings; resolve empty or non-terminating reviewer sessions without overlapping active scopes.
• 🔴 (03:32) Work tracker marked completed: recover full acceptance criteria for the lowest-numbered open issue; establish a failing regression or baseline; integrate all 18 OpenTofu adjudications; integrate Terraform subset C; integrate all 10 Valkey adjudications; harden frozen-input verification.
• 🟡 (03:33) Assistant determined the CLI fixes touch src/institution_lab/governance_adjudication.py, the same module under the still-active immutable-input audit; editing immediately would invalidate that reviewer’s working-copy evidence.
• 🟡 (03:33) Assistant deferred the CLI patch until the immutable-input audit’s completion notification, explicitly avoiding polling, duplication, overlap, or a race with the active reviewer.
• 🟡 (03:33) Follow-up lsly6ha5 was scheduled for 15 minutes with instructions to continue issue #4 from completed notifications only; if the immutable-input audit has completed, address both its findings and the completed CLI output-safety findings using deterministic fail-first regressions, then verify. If any relevant review remains active, retain exactly one follow-up.