cmd/corral/certify_repo.go at 2b02f27989, reviewed by claude-code, verified by codex.
--max-proven-missed passes a scan containing a file whose every mutant was rejected by the compile gate: nothing was graded, ProvenMissed is 0 because nothing was asked, and the gate reads that as a pass — the fourth untrustworthy zero, next to the three the same function already fails closed on.
#!/bin/sh
set -e
export GOPROXY=off GOFLAGS=-mod=readonly
cat > cmd/corral/zz_coldreview_gate_test.go <<'EOF'
package main
import (
"testing"
"github.com/pdbethke/corralai/internal/advpool"
"github.com/pdbethke/corralai/internal/reposcan"
)
// A MIXED scan: one file graded cleanly, one file whose every mutant was
// rejected by the compile gate (MutantsTotal 0, MutantsInvalid 7). Nothing was
// graded for the second file, so its ProvenMissed 0 answers no question.
func TestColdReviewNoGradableMutantPassesMaxProvenMissed(t *testing.T) {
results := []reposcan.FileResult{
{Job: reposcan.Job{Path: "pkg/clean.go", Lang: "go"}, Gradable: true,
Verdict: advpool.Verdict{DevKillRate: 1.0, MutantsTotal: 10, Survivors: 0, DevScored: true, PoolScored: true}},
{Job: reposcan.Job{Path: "pkg/nograde.go", Lang: "go"}, Gradable: true,
Verdict: advpool.Verdict{DevKillRate: 0, MutantsTotal: 0, MutantsInvalid: 7, Survivors: 0, DevScored: true}},
}
rep := reposcan.Aggregate("o", "o/r", "c0ffeec0ffee", 2, 2, results, nil)
t.Logf("report: Audited=%d GradedFiles=%d UngradableFiles=%d UncoveredFiles=%d TimedOut=%d",
rep.Audited, rep.GradedFiles, rep.UngradableFiles, rep.UncoveredFiles, rep.TimedOut)
for _, f := range rep.Weakest {
skr := "nil (WITHHELD from the signed statement)"
if p := signableKillRate(f); p != nil {
skr = "present"
}
t.Logf(" %s: killRate=%.2f survivors=%d provenMissed=%d mutantsGraded=%d mutantsInvalid=%d noGradableMutant=%v timedOut=%v writerFailed=%v poolUnsound=%v signableKillRate=%s",
f.Path, f.KillRate, f.Survivors, f.ProvenMissed, f.MutantsGraded, f.MutantsInvalid,
noGradableMutant(f), f.TimedOut, f.TestWriterFailed, f.PoolTestUnsound, skr)
}
zero := 0
code := repoScanExitCode(rep, false, 0, nil, &zero)
t.Logf("repoScanExitCode(--max-proven-missed 0) = %d", code)
if code != 0 {
t.Fatalf("NO DEFECT: the gate returned %d", code)
}
t.Log("DEFECT: exit 0 — a file corral refused to sign a kill rate for, because nothing was graded, satisfied --max-proven-missed 0")
}
EOF
go test -count=1 -v -run TestColdReviewNoGradableMutantPassesMaxProvenMissed ./cmd/corral=== RUN TestColdReviewNoGradableMutantPassesMaxProvenMissed
zz_coldreview_gate_test.go:21: report: Audited=2 GradedFiles=1 UngradableFiles=1 UncoveredFiles=0 TimedOut=0
zz_coldreview_gate_test.go:28: pkg/nograde.go: killRate=0.00 survivors=0 provenMissed=0 mutantsGraded=0 mutantsInvalid=7 noGradableMutant=true timedOut=false writerFailed=false poolUnsound=false signableKillRate=nil (WITHHELD from the signed statement)
zz_coldreview_gate_test.go:28: pkg/clean.go: killRate=1.00 survivors=0 provenMissed=0 mutantsGraded=10 mutantsInvalid=0 noGradableMutant=false timedOut=false writerFailed=false poolUnsound=false signableKillRate=present
zz_coldreview_gate_test.go:34: repoScanExitCode(--max-proven-missed 0) = 0
zz_coldreview_gate_test.go:38: DEFECT: exit 0 — a file corral refused to sign a kill rate for, because nothing was graded, satisfied --max-proven-missed 0
--- PASS: TestColdReviewNoGradableMutantPassesMaxProvenMissed (0.00s)
PASS
ok github.com/pdbethke/corralai/cmd/corral 0.012sI traced repoScanExitCode through the mixed-report case. The general GradedFiles guard fires only when GradedFiles == 0, while the --max-proven-missed loop rejects an untrustworthy zero only when Survivors > 0 and one of the writer/unsound/unscored-timeout conditions holds. A WeakFile with zero graded mutants, positive MutantsInvalid, zero survivors, and ProvenMissed 0 therefore passes in a mixed scan despite noGradableMutant and signableKillRate treating its rate as unmeasured. I found no later exit-code check that closes this path.
ref 762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R1
printWeakFile prints a literal "0.00" kill rate for a NO-GRADABLE-MUTANT file — the same fabricated zero it prints "withheld" for when the file is Uncovered, and the same zero signableKillRate refuses to put in the signed statement.
#!/bin/sh
set -e
export GOPROXY=off GOFLAGS=-mod=readonly
cat > cmd/corral/zz_coldreview_print_test.go <<'EOF'
package main
import (
"strings"
"testing"
"github.com/pdbethke/corralai/internal/reposcan"
)
func TestColdReviewPrintsFabricatedRateForNoGradableMutant(t *testing.T) {
nograde := reposcan.WeakFile{Path: "pkg/nograde.go", KillRate: 0, MutantsGraded: 0, MutantsInvalid: 7}
uncovered := reposcan.WeakFile{Path: "pkg/dead.go", KillRate: 0, Uncovered: true, MutantsGraded: 4}
var a, b strings.Builder
printWeakFile(&a, nograde)
printWeakFile(&b, uncovered)
t.Logf("no-gradable-mutant line: %q", strings.TrimRight(a.String(), "\n"))
t.Logf("uncovered line: %q", strings.TrimRight(b.String(), "\n"))
t.Logf("signableKillRate(no-gradable-mutant) = %v (nil => the signed statement withholds it)", signableKillRate(nograde))
t.Logf("signableKillRate(uncovered) = %v", signableKillRate(uncovered))
if signableKillRate(nograde) != nil {
t.Fatal("NO DEFECT: the statement carries a rate for this file too")
}
if !strings.Contains(b.String(), "withheld") {
t.Fatal("NO DEFECT: the uncovered line does not say withheld, so there is no asymmetry")
}
if !strings.HasPrefix(strings.TrimSpace(a.String()), "0.00") {
t.Fatalf("NO DEFECT: the report did not print a rate: %q", a.String())
}
t.Log("DEFECT: the human report prints 0.00 for a file whose rate the signed statement refuses to carry, while the Uncovered case on the same code path prints 'withheld'")
}
EOF
go test -count=1 -v -run TestColdReviewPrintsFabricatedRateForNoGradableMutant ./cmd/corral=== RUN TestColdReviewPrintsFabricatedRateForNoGradableMutant
zz_coldreview_print_test.go:17: no-gradable-mutant line: " 0.00 pkg/nograde.go (0 survivor(s)) [NO GRADABLE MUTANT — all 7 rejected by the compile check]"
zz_coldreview_print_test.go:18: uncovered line: " withheld pkg/dead.go (0 survivor(s)) [UNCOVERED — no test executes this file]"
zz_coldreview_print_test.go:19: signableKillRate(no-gradable-mutant) = <nil> (nil => the signed statement withholds it)
zz_coldreview_print_test.go:20: signableKillRate(uncovered) = <nil>
zz_coldreview_print_test.go:31: DEFECT: the human report prints 0.00 for a file whose rate the signed statement refuses to carry, while the Uncovered case on the same code path prints 'withheld'
--- PASS: TestColdReviewPrintsFabricatedRateForNoGradableMutant (0.00s)
PASS
ok github.com/pdbethke/corralai/cmd/corral 0.011sI inspected printWeakFile and signableKillRate. The noGradableMutant branch adds an explanatory marker, but the rate is changed to "withheld" only when f.Uncovered is true. Thus a no-gradable-mutant file prints fmt.Sprintf("%.2f", f.KillRate), normally 0.00, while signableKillRate returns nil for the same condition. The marker explains the problem but does not refute the specific claim that the human-facing numeric rate is fabricated and inconsistent with the signed representation.
ref 762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R2
On the --diff-base path, evidence widening appends candidates to `selected` with no --top bound, so an explicit --top that the same branch deliberately honours 400 lines earlier can be exceeded — the exact second door the whole-repo branch re-ranks under the bound to close.
I followed selection before and after evidence widening. The diff branch initially applies an explicit --top using Rank and Select. Later, WidenCandidacyByEvidence adds evidence-only candidates to selected when their source or a covering test changed, without re-ranking or reapplying effectiveTop. The re-ranking block under the same bound is explicitly guarded by diffBase == "", so it cannot protect the diff branch. I found no downstream truncation before jobs are created.
ref 762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R3
unpairableInDiff is collected only for reposcan.ReasonNoPairedTest, so a changed source excluded as `ambiguous-test` (candidate.go:740) is neither audited nor reported: selected is empty, nothingInScope is true, skipEvidence suppresses the one pass that might rescue it, and the merge gate exits 0 on a pull request whose only changed source file was never looked at.
I traced an ambiguity exclusion from internal/reposcan/candidate.go into this file. Demoted collisions receive ReasonAmbiguousTest, but unpairableInDiff collects only ReasonNoPairedTest plus sources orphaned by deleted tests. WidenCandidacyByEvidence promotes only no-paired-test exclusions. For a diff changing only such an ambiguous source, selected and unpairableInDiff remain empty, diffTouchedATest is false, skipEvidence becomes true, nothingInScope becomes true, and repoScanExitCode returns 0. I found no broader changed-source exclusion check that reports or fails this case.
ref 762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R4
The --push rows are stamped with `entries[len(entries)-1].Hash` read from the ledger directory regardless of whether THIS scan's ledger write just failed, so a failed entry write (full disk, lock contention — a fail-open path by design) leaves every pushed warehouse row pointing at the PREVIOUS scan's entry hash.
I traced the ledger write and subsequent push. pushBundle(ledgerDir+"/", entryBundle) reports failure but records no success state. The push block then independently reads ledgerDir and, whenever reading succeeds and prior entries exist, assigns the last entry’s hash to bundle.Scan.EntryHash. It does not verify that this scan’s ledger write succeeded or that the selected entry has this scanID. Therefore a write failure compatible with a subsequent successful read of an existing ledger can attach the previous entry hash to the new push. I found no later canonicalization or push-time validation that corrects that provenance.
ref 762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R5
Recorded so that "found nothing here" can be told apart from "never looked here".
This file is unusually well-defended — most of the traps a cold reviewer reaches for (the `--` argv collision, the stray-positional silent-no-gate, NaN in `--min-kill-rate`, the `-`-prefixed `--diff-base` git-option injection, three-dot vs two-dot diff, the deleted-test orphan case, the uncovered-file withheld rate) are already closed, and closed with the reasoning written down. The defects that remain are all the same shape the repo's own comments keep naming: a rule installed at one door and not at the others. Finding 1 is the clearest: `repoScanExitCode` enumerates three reasons a `ProvenMissed` of 0 is untrustworthy (writer failed, test unsound, timed out without a pool score) and misses the fourth the very same file already knows about — every mutant rejected by the compile gate, which `signableKillRate`/`noGradableMutant` treat as a fabrication and refuse to sign, while `--max-proven-missed 0` passes it. Finding 2 is the small sibling of the same asymmetry inside the printer: the human line prints the 0.00 that every machine consumer withholds. Findings 3 and 4 are the two doors on the `--diff-base` merge gate — the `--top` bound that the evidence-widening path re-applies on the whole-repo branch and does not on the diff branch, and the unpairable-in-diff accounting that only knows one exclusion reason out of several. Finding 5 is a provenance one: a warehouse row can be stamped with the previous scan's ledger entry hash when this scan's ledger write fails. None of these are in the crypto or the hashing, which I could not break.
All five findings stand. R1 and R2 are directly supported by the reviewer’s focused tests and by the corresponding gate and rendering branches. R3–R5 are confirmed by tracing the relevant control and data flows; I found no compensating bound, exclusion accounting, or successful-write discriminator that narrows or defeats the claims.