- questionIdsFor and condensedHintFor take an optional
{ externalContract: true }; without it a code change that handles data
asks data-schema only, and an unknown profile gets the original four
questions and condensed hint.
- The hook reads GATEGUARD_EXTERNAL_CONTRACT_QUESTION with the same
spellings as GATEGUARD_METRICS and passes it to the full denial, the
condensed denial and the metrics record, so all three agree.
- The effectiveness harness's arm patch forwards the option, so an arm
never drops it silently.
Docs: change-profile.md gains an External-contract question section and
qualifies "byte-identical to the fixed four questions"; design-notes.md,
SKILL.md (switch table, data rule, word-for-word set) and CHANGELOG say
the fifth question is opt-in; question-effectiveness.md and the harness
README note that the runner clears GATEGUARD_* variables, so a gate arm
from a current tree measures the gate without the question.
skill-triggers@1.json: registryDigest refreshed for the SKILL.md body
change; the description and triggers are unchanged.
8a7d6129 added the external-contract question for every code change that
handles data and updated the pinned tests to match, including the legacy
test "code condensed Edit hint for an unknown profile is unchanged". Its own
evaluation then found the gated arm did not improve (25 to 23 of 48), so the
question has no evidence behind it as a default.
- Restore the test expectations 8a7d6129 changed: questionIdsFor, the
byte-identical code text for src/a.py, the condensed hints, and the hook
question lists default to data-schema without external-contract.
- Add questionIdsFor/condensedHintFor cases with { externalContract: true }.
- Add hook cases: GATEGUARD_EXTERNAL_CONTRACT_QUESTION=1/true/ON asks it
beside data-schema and in the unknown-profile set, never without data;
unset, 0, false and off keep the original four.
Against main: target-class 5 failures, fact-force 10 failures.
- design-notes.md: new Type filters and Path patterns sections; Search
scope extends the search-of-the-target rule to name lookups; Flag
parsing lists the new value flags.
- change-profile.md: Unicode line terminators make an edit non-trivial.
- skills/gateguard/SKILL.md and CHANGELOG.md describe the same rules.
- skill-triggers@1.json: refresh registryDigest for the SKILL.md body
change. The skill's description is unchanged, so triggers and
triggersDigest are untouched, as in the plan-orchestrate refresh.
- Read file-type filters as include and exclusion globs: rg -t/--type
and the Grep tool's type include ripgrep 14.1's globs for the type,
rg -T/--type-not exclude them, fd -e/--extension includes *.<ext>.
An unknown type name, --type-add or --type-clear is an unreadable
filter and never credits, like --exclude-from.
- Treat a path pattern as a filter: the Glob tool's pattern must match
the target below its root; a shell glob operand must match the target
or a directory above it; a git pathspec matches the same way with its
* also matching /. One operand that admits the target is enough.
- Extend "a search of the target itself gives nothing" to searches
confined to the target's own file name: when every include, the Glob
pattern, or every path pattern ends in that exact name, the stem never
credits, and the closest-miss note says it was a lookup.
- Tokenize PowerShell searches with backslashes kept as path separators,
as the read-only shell check already does; the old literal-prefix scope
hid that src\core\*.ts reached the parser as srccore*.ts.
- Make an edit non-trivial when either text holds U+2028, U+2029 or
U+0085, which end a JavaScript or C# line comment; the lexer splits
lines only at \n and \r.
Extracting applyLongFilter, grepDetail and stemCredits leaves every
touched function at or below its complexity on main.
Each of these is credited on main, reproduced against upstream 2d515e4f:
- rg -t py / -T js / --type-not js, fd -e py, and the Grep tool's
type: "py" credit an Edit of tokenizer.js. Type and extension values
are skipped as plain value flags, so they never filter.
- Glob **/tokenizer.py, rg tokenizer src/*.py, and
git grep tokenizer -- '*.py' credit tokenizer.js. The Glob pattern is
never a filter, and a glob operand scopes as its literal directory.
- Glob **/tokenizer.js, find -name tokenizer.js, rg -g tokenizer.js and
Grep glob: "tokenizer.js" credit tokenizer.js, although each search
could only find the target itself.
- An Edit of "// note<U+2028>foo(1);" to "// note<U+2028>foo(2);" passes
as comment-only, although JavaScript ends the comment at U+2028 and
foo(2) runs.
Scenario 21-bypass-filter-forms adds ten must-deny steps and four
controls. Four hook controls that asserted exact-name lookups still
credit (find -name widget.py, Grep glob widget.py, Get-ChildItem
-Filter widget.py) now assert the lookup is denied; each keeps its
original purpose, that the exclusion parser leaves a positive include
alone, through a wildcard include (widget.*).
Replace JSON-interpolated child JavaScript with fixed preload and summarizer programs. Pass paths and dates through dedicated fixture environment variables; use a fixed quoted exec wrapper so configured executable and script paths remain data. Preserve real Date.now, deadlines, calendar rollover, captured resume metadata and no-next-day duplicate assertions. Actual13/0 Node18.20.8, Node20.20.2 with Bun setting and Node24.9.0; actual13/0 with spaces/apostrophes/literal dollar in fixture paths; next-day negative control12/1; lint and diff checks pass. Addresses CodeQL393/394/395 without suppression or dismissal.
The Stop hook captures its session filename date before waiting for a slow summary, while the fixture previously recomputed it after timeout. Advance only the fixture calendar when the fake summarizer starts and assert persistence under the captured date, matching resume metadata, and no next-day duplicate. Keep Date.now, child delay and lifecycle deadlines unchanged. Actual workflow baseline and corrected fixture13/0; mismatched-day lookup negative control12/1; Node20 with Bun setting and Node18.20.8 both13/0; lint and diff checks pass.
Verify PCRE2 on every hosted test platform and coverage runner. Preserve dependency PATH for real scanner delegates and report missing prerequisites explicitly, keeping production fail-closed behavior and hermetic missing/error controls intact.
Isolate spawned Stop hooks through TMPDIR/TMP/TEMP, open transcript fixtures exclusively with private modes, and derive intentional stale-race fixture identity from its opened descriptor.
