cmd/corral at de0d9860ee, reviewed by claude-code, verified by codex.
`corral seal --repo --json` reports the row's PUSH time in a field named "audited", never reading AuditedAt, so a machine consumer is told a scan ran on the day its row was pushed — the exact distinction the text table's auditedLabel exists to keep.
#!/bin/sh
cat > cmd/corral/zz_coldreview_test.go <<'GOEOF'
package main
import (
"bytes"
"encoding/json"
"strings"
"testing"
"time"
"github.com/pdbethke/corralai/internal/auditpush"
"github.com/pdbethke/corralai/internal/review"
)
func TestZZColdSealJSONAuditedIsPushTime(t *testing.T) {
audited := time.Date(2024, 1, 2, 3, 4, 0, 0, time.UTC)
pushed := time.Date(2026, 9, 7, 12, 0, 0, 0, time.UTC)
row := sealRow{Repo: "r", Path: "a.go", ParentSHA256: "deadbeef", KillRate: 0.5,
TS: pushed, AuditedAt: &audited}
var buf bytes.Buffer
emitSealStateJSON([]sealState{{Path: "a.go", State: "live", Row: &row}}, &buf)
t.Logf("emitSealStateJSON wrote:\n%s", buf.String())
var got []map[string]any
if err := json.Unmarshal(buf.Bytes(), &got); err != nil {
t.Fatalf("output is not JSON: %v", err)
}
aud, _ := got[0]["audited"].(string)
t.Logf("the scan RAN at %s", audited.Format(time.RFC3339))
t.Logf("the row was PUSHED at %s", pushed.Format(time.RFC3339))
t.Logf("the JSON field \"audited\" says %s", aud)
t.Logf("the text door (auditedLabel) says %q for the same row", row.auditedLabel())
if aud == audited.Format(time.RFC3339) {
t.Fatalf("no defect: \"audited\" carries the audit time")
}
if aud != pushed.Format(time.RFC3339) {
t.Fatalf("no defect: \"audited\" is neither time (%q)", aud)
}
}
func TestZZColdSealJSONDropsCaveats(t *testing.T) {
row := sealRow{Repo: "r", Path: "a.go", KillRate: 1.0, Survivors: 5, ProvenMissed: 0,
TS: time.Date(2026, 9, 7, 12, 0, 0, 0, time.UTC),
TestWriterFailed: true, PoolTestUnsound: true, BaselineFailed: true}
var buf bytes.Buffer
emitSealStateJSON([]sealState{{Path: "a.go", State: "live", Row: &row}}, &buf)
t.Logf("the text table prints CAVEAT=%q for this row", row.caveat())
t.Logf("emitSealStateJSON wrote:\n%s", buf.String())
var got []map[string]any
if err := json.Unmarshal(buf.Bytes(), &got); err != nil {
t.Fatalf("output is not JSON: %v", err)
}
var keys []string
for k := range got[0] {
keys = append(keys, k)
}
t.Logf("the JSON row carries only these keys: %v", keys)
for _, k := range []string{"caveat", "test_writer_failed", "pool_test_unsound", "baseline_failed"} {
if _, ok := got[0][k]; ok {
t.Fatalf("no defect: %q is carried in the JSON", k)
}
}
t.Logf("5 survivors / 0 proven, baseline failed AND writer failed AND test unsound — and the JSON says nothing")
}
func TestZZColdUIShowsRetractedReview(t *testing.T) {
dir := t.TempDir()
r := review.Review{Repo: "r", Commit: "0123456789abcdef0123456789abcdef01234567", Scope: "cmd/corral",
ReviewerModel: "some-model",
Findings: []review.Finding{{ID: "R1", Claim: "a claim that was retracted", Declared: "CODE-READ", Tier: "CODE-READ", File: "cmd/corral/seal.go"}}}
if _, err := auditpush.WriteReview(dir, r, nil); err != nil {
t.Fatalf("WriteReview: %v", err)
}
entries, err := auditpush.ReadLedgerDir(dir)
if err != nil || len(entries) != 1 {
t.Fatalf("ReadLedgerDir: %v, %d entries", err, len(entries))
}
hash := entries[0].Hash
if _, err := auditpush.WriteRetraction(dir, hash, "the reviewer hallucinated the whole finding", nil); err != nil {
t.Fatalf("WriteRetraction: %v", err)
}
all, err := auditpush.ReadLedgerDir(dir)
if err != nil {
t.Fatalf("ReadLedgerDir: %v", err)
}
nLive := 0
for _, e := range auditpush.LiveEntries(all) {
if e.Kind == auditpush.KindReview {
nLive++
}
}
u, err := readUILedger(dir)
if err != nil {
t.Fatalf("readUILedger: %v", err)
}
t.Logf("review %.12s was retracted", hash)
t.Logf("auditpush.LiveEntries (the reader `brief`, the view and the push go through) keeps %d review(s)", nLive)
t.Logf("readUILedger (what `corral ui` renders) keeps %d review(s)", len(u.Reviews))
if nLive != 0 {
t.Fatalf("no defect: LiveEntries still keeps the retracted review")
}
if len(u.Reviews) != 1 {
t.Fatalf("no defect: the ui dropped the retracted review too")
}
for _, e := range u.Entries {
if e.Hash == hash {
t.Logf("the ui chain row for it: kind=%q note=%q problem=%q", e.Kind, e.Note, e.Problem)
if strings.Contains(strings.ToUpper(e.Note), "RETRACT") {
t.Fatalf("no defect: the ui marks the entry retracted")
}
}
}
t.Logf("corral ui renders it as a live review, unmarked: scope=%s reviewer=%s findings=%d",
u.Reviews[0].Scope, u.Reviews[0].Reviewer, len(u.Reviews[0].Findings))
}
GOEOF
if go test -count=1 -run TestZZColdSealJSONAuditedIsPushTime -v ./cmd/corral/ > zz_out.txt 2>&1; then
cat zz_out.txt
exit 0
fi
cat zz_out.txt
exit 1=== RUN TestZZColdSealJSONAuditedIsPushTime
zz_coldreview_test.go:21: emitSealStateJSON wrote:
[
{
"state": "live",
"path": "a.go",
"kill_rate": 0.5,
"survivors": 0,
"proven_missed": 0,
"trees": 0,
"audited": "2026-09-07T12:00:00Z"
}
]
zz_coldreview_test.go:27: the scan RAN at 2024-01-02T03:04:00Z
zz_coldreview_test.go:28: the row was PUSHED at 2026-09-07T12:00:00Z
zz_coldreview_test.go:29: the JSON field "audited" says 2026-09-07T12:00:00Z
zz_coldreview_test.go:30: the text door (auditedLabel) says "2024-01-02 03:04" for the same row
--- PASS: TestZZColdSealJSONAuditedIsPushTime (0.00s)
PASS
ok github.com/pdbethke/corralai/cmd/corral 0.012sI traced the repository JSON path in cmd/corral/seal.go. emitSealStateJSON formats s.Row.TS into the field named `audited`; it never consults AuditedAt. In the same file, auditedLabel prefers AuditedAt and labels TS as `(push)` only as a fallback. I found no later transformation that corrects the JSON value.
confirmed by pdbethke — real, reproduced: seal --json names the push time 'audited'
ref 8377ae6320ccf8473acde31eed5b23c5fe7c21b41986b53bed2b18027756a65a#R1
`corral seal --repo --json` drops every honesty flag (test_writer_failed, pool_test_unsound, baseline_failed) that the text table prints as CAVEAT, so a JSON consumer reads "kill rate 1.00, 5 survivors, 0 proven" for a file whose authored test never compiled and whose baseline never passed.
#!/bin/sh
cat > cmd/corral/zz_coldreview_test.go <<'GOEOF'
package main
import (
"bytes"
"encoding/json"
"strings"
"testing"
"time"
"github.com/pdbethke/corralai/internal/auditpush"
"github.com/pdbethke/corralai/internal/review"
)
func TestZZColdSealJSONAuditedIsPushTime(t *testing.T) {
audited := time.Date(2024, 1, 2, 3, 4, 0, 0, time.UTC)
pushed := time.Date(2026, 9, 7, 12, 0, 0, 0, time.UTC)
row := sealRow{Repo: "r", Path: "a.go", ParentSHA256: "deadbeef", KillRate: 0.5,
TS: pushed, AuditedAt: &audited}
var buf bytes.Buffer
emitSealStateJSON([]sealState{{Path: "a.go", State: "live", Row: &row}}, &buf)
t.Logf("emitSealStateJSON wrote:\n%s", buf.String())
var got []map[string]any
if err := json.Unmarshal(buf.Bytes(), &got); err != nil {
t.Fatalf("output is not JSON: %v", err)
}
aud, _ := got[0]["audited"].(string)
t.Logf("the scan RAN at %s", audited.Format(time.RFC3339))
t.Logf("the row was PUSHED at %s", pushed.Format(time.RFC3339))
t.Logf("the JSON field \"audited\" says %s", aud)
t.Logf("the text door (auditedLabel) says %q for the same row", row.auditedLabel())
if aud == audited.Format(time.RFC3339) {
t.Fatalf("no defect: \"audited\" carries the audit time")
}
if aud != pushed.Format(time.RFC3339) {
t.Fatalf("no defect: \"audited\" is neither time (%q)", aud)
}
}
func TestZZColdSealJSONDropsCaveats(t *testing.T) {
row := sealRow{Repo: "r", Path: "a.go", KillRate: 1.0, Survivors: 5, ProvenMissed: 0,
TS: time.Date(2026, 9, 7, 12, 0, 0, 0, time.UTC),
TestWriterFailed: true, PoolTestUnsound: true, BaselineFailed: true}
var buf bytes.Buffer
emitSealStateJSON([]sealState{{Path: "a.go", State: "live", Row: &row}}, &buf)
t.Logf("the text table prints CAVEAT=%q for this row", row.caveat())
t.Logf("emitSealStateJSON wrote:\n%s", buf.String())
var got []map[string]any
if err := json.Unmarshal(buf.Bytes(), &got); err != nil {
t.Fatalf("output is not JSON: %v", err)
}
var keys []string
for k := range got[0] {
keys = append(keys, k)
}
t.Logf("the JSON row carries only these keys: %v", keys)
for _, k := range []string{"caveat", "test_writer_failed", "pool_test_unsound", "baseline_failed"} {
if _, ok := got[0][k]; ok {
t.Fatalf("no defect: %q is carried in the JSON", k)
}
}
t.Logf("5 survivors / 0 proven, baseline failed AND writer failed AND test unsound — and the JSON says nothing")
}
func TestZZColdUIShowsRetractedReview(t *testing.T) {
dir := t.TempDir()
r := review.Review{Repo: "r", Commit: "0123456789abcdef0123456789abcdef01234567", Scope: "cmd/corral",
ReviewerModel: "some-model",
Findings: []review.Finding{{ID: "R1", Claim: "a claim that was retracted", Declared: "CODE-READ", Tier: "CODE-READ", File: "cmd/corral/seal.go"}}}
if _, err := auditpush.WriteReview(dir, r, nil); err != nil {
t.Fatalf("WriteReview: %v", err)
}
entries, err := auditpush.ReadLedgerDir(dir)
if err != nil || len(entries) != 1 {
t.Fatalf("ReadLedgerDir: %v, %d entries", err, len(entries))
}
hash := entries[0].Hash
if _, err := auditpush.WriteRetraction(dir, hash, "the reviewer hallucinated the whole finding", nil); err != nil {
t.Fatalf("WriteRetraction: %v", err)
}
all, err := auditpush.ReadLedgerDir(dir)
if err != nil {
t.Fatalf("ReadLedgerDir: %v", err)
}
nLive := 0
for _, e := range auditpush.LiveEntries(all) {
if e.Kind == auditpush.KindReview {
nLive++
}
}
u, err := readUILedger(dir)
if err != nil {
t.Fatalf("readUILedger: %v", err)
}
t.Logf("review %.12s was retracted", hash)
t.Logf("auditpush.LiveEntries (the reader `brief`, the view and the push go through) keeps %d review(s)", nLive)
t.Logf("readUILedger (what `corral ui` renders) keeps %d review(s)", len(u.Reviews))
if nLive != 0 {
t.Fatalf("no defect: LiveEntries still keeps the retracted review")
}
if len(u.Reviews) != 1 {
t.Fatalf("no defect: the ui dropped the retracted review too")
}
for _, e := range u.Entries {
if e.Hash == hash {
t.Logf("the ui chain row for it: kind=%q note=%q problem=%q", e.Kind, e.Note, e.Problem)
if strings.Contains(strings.ToUpper(e.Note), "RETRACT") {
t.Fatalf("no defect: the ui marks the entry retracted")
}
}
}
t.Logf("corral ui renders it as a live review, unmarked: scope=%s reviewer=%s findings=%d",
u.Reviews[0].Scope, u.Reviews[0].Reviewer, len(u.Reviews[0].Findings))
}
GOEOF
if go test -count=1 -run TestZZColdSealJSONDropsCaveats -v ./cmd/corral/ > zz_out.txt 2>&1; then
cat zz_out.txt
exit 0
fi
cat zz_out.txt
exit 1=== RUN TestZZColdSealJSONDropsCaveats
zz_coldreview_test.go:45: the text table prints CAVEAT="BASELINE-FAILED" for this row
zz_coldreview_test.go:46: emitSealStateJSON wrote:
[
{
"state": "live",
"path": "a.go",
"kill_rate": 1,
"survivors": 5,
"proven_missed": 0,
"trees": 0,
"audited": "2026-09-07T12:00:00Z"
}
]
zz_coldreview_test.go:55: the JSON row carries only these keys: [audited state path kill_rate survivors proven_missed trees]
zz_coldreview_test.go:61: 5 survivors / 0 proven, baseline failed AND writer failed AND test unsound — and the JSON says nothing
--- PASS: TestZZColdSealJSONDropsCaveats (0.00s)
PASS
ok github.com/pdbethke/corralai/cmd/corral 0.012sI compared sealRow, caveat(), and sealStateJSON in cmd/corral/seal.go. sealRow carries TestWriterFailed, PoolTestUnsound, and BaselineFailed, and caveat() renders their prioritized warning. sealStateJSON has neither those booleans nor a caveat field, and emitSealStateJSON copies only kill rate, survivors, proven missed, trees, and timestamp. Thus the machine-facing repository shape loses the qualification.
confirmed by pdbethke — real, reproduced: seal --json drops every honesty flag the text table prints as CAVEAT
ref 8377ae6320ccf8473acde31eed5b23c5fe7c21b41986b53bed2b18027756a65a#R2
`corral ui` reads the raw ledger entries instead of auditpush.LiveEntries, so a RETRACTED review is still rendered in the REVIEWS section as a live review with its findings, and only scan entries ever get the "RETRACTED" note — the retraction has no effect at this door.
#!/bin/sh
cat > cmd/corral/zz_coldreview_test.go <<'GOEOF'
package main
import (
"bytes"
"encoding/json"
"strings"
"testing"
"time"
"github.com/pdbethke/corralai/internal/auditpush"
"github.com/pdbethke/corralai/internal/review"
)
func TestZZColdSealJSONAuditedIsPushTime(t *testing.T) {
audited := time.Date(2024, 1, 2, 3, 4, 0, 0, time.UTC)
pushed := time.Date(2026, 9, 7, 12, 0, 0, 0, time.UTC)
row := sealRow{Repo: "r", Path: "a.go", ParentSHA256: "deadbeef", KillRate: 0.5,
TS: pushed, AuditedAt: &audited}
var buf bytes.Buffer
emitSealStateJSON([]sealState{{Path: "a.go", State: "live", Row: &row}}, &buf)
t.Logf("emitSealStateJSON wrote:\n%s", buf.String())
var got []map[string]any
if err := json.Unmarshal(buf.Bytes(), &got); err != nil {
t.Fatalf("output is not JSON: %v", err)
}
aud, _ := got[0]["audited"].(string)
t.Logf("the scan RAN at %s", audited.Format(time.RFC3339))
t.Logf("the row was PUSHED at %s", pushed.Format(time.RFC3339))
t.Logf("the JSON field \"audited\" says %s", aud)
t.Logf("the text door (auditedLabel) says %q for the same row", row.auditedLabel())
if aud == audited.Format(time.RFC3339) {
t.Fatalf("no defect: \"audited\" carries the audit time")
}
if aud != pushed.Format(time.RFC3339) {
t.Fatalf("no defect: \"audited\" is neither time (%q)", aud)
}
}
func TestZZColdSealJSONDropsCaveats(t *testing.T) {
row := sealRow{Repo: "r", Path: "a.go", KillRate: 1.0, Survivors: 5, ProvenMissed: 0,
TS: time.Date(2026, 9, 7, 12, 0, 0, 0, time.UTC),
TestWriterFailed: true, PoolTestUnsound: true, BaselineFailed: true}
var buf bytes.Buffer
emitSealStateJSON([]sealState{{Path: "a.go", State: "live", Row: &row}}, &buf)
t.Logf("the text table prints CAVEAT=%q for this row", row.caveat())
t.Logf("emitSealStateJSON wrote:\n%s", buf.String())
var got []map[string]any
if err := json.Unmarshal(buf.Bytes(), &got); err != nil {
t.Fatalf("output is not JSON: %v", err)
}
var keys []string
for k := range got[0] {
keys = append(keys, k)
}
t.Logf("the JSON row carries only these keys: %v", keys)
for _, k := range []string{"caveat", "test_writer_failed", "pool_test_unsound", "baseline_failed"} {
if _, ok := got[0][k]; ok {
t.Fatalf("no defect: %q is carried in the JSON", k)
}
}
t.Logf("5 survivors / 0 proven, baseline failed AND writer failed AND test unsound — and the JSON says nothing")
}
func TestZZColdUIShowsRetractedReview(t *testing.T) {
dir := t.TempDir()
r := review.Review{Repo: "r", Commit: "0123456789abcdef0123456789abcdef01234567", Scope: "cmd/corral",
ReviewerModel: "some-model",
Findings: []review.Finding{{ID: "R1", Claim: "a claim that was retracted", Declared: "CODE-READ", Tier: "CODE-READ", File: "cmd/corral/seal.go"}}}
if _, err := auditpush.WriteReview(dir, r, nil); err != nil {
t.Fatalf("WriteReview: %v", err)
}
entries, err := auditpush.ReadLedgerDir(dir)
if err != nil || len(entries) != 1 {
t.Fatalf("ReadLedgerDir: %v, %d entries", err, len(entries))
}
hash := entries[0].Hash
if _, err := auditpush.WriteRetraction(dir, hash, "the reviewer hallucinated the whole finding", nil); err != nil {
t.Fatalf("WriteRetraction: %v", err)
}
all, err := auditpush.ReadLedgerDir(dir)
if err != nil {
t.Fatalf("ReadLedgerDir: %v", err)
}
nLive := 0
for _, e := range auditpush.LiveEntries(all) {
if e.Kind == auditpush.KindReview {
nLive++
}
}
u, err := readUILedger(dir)
if err != nil {
t.Fatalf("readUILedger: %v", err)
}
t.Logf("review %.12s was retracted", hash)
t.Logf("auditpush.LiveEntries (the reader `brief`, the view and the push go through) keeps %d review(s)", nLive)
t.Logf("readUILedger (what `corral ui` renders) keeps %d review(s)", len(u.Reviews))
if nLive != 0 {
t.Fatalf("no defect: LiveEntries still keeps the retracted review")
}
if len(u.Reviews) != 1 {
t.Fatalf("no defect: the ui dropped the retracted review too")
}
for _, e := range u.Entries {
if e.Hash == hash {
t.Logf("the ui chain row for it: kind=%q note=%q problem=%q", e.Kind, e.Note, e.Problem)
if strings.Contains(strings.ToUpper(e.Note), "RETRACT") {
t.Fatalf("no defect: the ui marks the entry retracted")
}
}
}
t.Logf("corral ui renders it as a live review, unmarked: scope=%s reviewer=%s findings=%d",
u.Reviews[0].Scope, u.Reviews[0].Reviewer, len(u.Reviews[0].Findings))
}
GOEOF
if go test -count=1 -run TestZZColdUIShowsRetractedReview -v ./cmd/corral/ > zz_out.txt 2>&1; then
cat zz_out.txt
exit 0
fi
cat zz_out.txt
exit 1=== RUN TestZZColdUIShowsRetractedReview
zz_coldreview_test.go:94: review cdcc531d975e was retracted
zz_coldreview_test.go:95: auditpush.LiveEntries (the reader `brief`, the view and the push go through) keeps 0 review(s)
zz_coldreview_test.go:96: readUILedger (what `corral ui` renders) keeps 1 review(s)
zz_coldreview_test.go:105: the ui chain row for it: kind="review" note="review of cmd/corral by some-model: 0 reproduced, 1 code-read, 0 hypothesis" problem=""
zz_coldreview_test.go:111: corral ui renders it as a live review, unmarked: scope=cmd/corral reviewer=some-model findings=1
--- PASS: TestZZColdUIShowsRetractedReview (0.01s)
PASS
ok github.com/pdbethke/corralai/cmd/corral 0.018sI followed readUILedger in cmd/corral/ui_ledger.go. It reads raw entries and computes auditpush.Retracted(entries), but checks that map only inside the KindScan branch. The KindReview branch unconditionally constructs and appends uiReview, including every finding. auditpush.LiveEntries in internal/auditpush/ledgerdir.go would remove the review, but this UI path does not call it.
confirmed by pdbethke — real, reproduced: corral ui renders a retracted review as live — the retraction has no effect at this door
ref 8377ae6320ccf8473acde31eed5b23c5fe7c21b41986b53bed2b18027756a65a#R3
The shipped, drift-gated CLI reference documents `corral scans push`, a verb the dispatcher does not have, and the body of that reference section is the unknown-subcommand error the verb produces.
#!/bin/sh ok=0 if grep -q '## `corral scans push` flags' docs/cli/corral.md && \ grep -q 'unknown subcommand "push" — want list or show' docs/cli/corral.md; then ok=1 fi if [ "$ok" != "1" ]; then echo "no defect: docs/cli/corral.md has no such section" exit 1 fi echo "=== the shipped CLI reference, docs/cli/corral.md ===" grep -n -A5 '## `corral scans push` flags' docs/cli/corral.md echo echo "=== the same text in the published site copy ===" grep -n -A5 '## `corral scans push` flags' site/src/content/docs/docs/cli/corral.md echo echo "=== every verb cmd/corral/scans.go actually dispatches (runScans) ===" sed -n '85,94p' cmd/corral/scans.go echo echo "=== the generator that asks the binary for a verb it does not have ===" grep -n 'scans push' scripts/gen-cli-docs.sh echo echo "the reference documents a non-existent verb, and the drift gate stays green because it compares the generator's output to itself" exit 0
=== the shipped CLI reference, docs/cli/corral.md ===
731:## `corral scans push` flags
732-
733-```
734-corral scans: unknown subcommand "push" — want list or show
735-```
736-
=== the same text in the published site copy ===
731:## `corral scans push` flags
732-
733-```
734-corral scans: unknown subcommand "push" — want list or show
735-```
736-
=== every verb cmd/corral/scans.go actually dispatches (runScans) ===
switch args[0] {
case "list":
return runScansList(args[1:], open, stdout, stderr)
case "show":
return runScansShow(args[1:], open, stdout, stderr)
default:
fmt.Fprintf(stderr, "corral scans: unknown subcommand %q — want list or show\n", args[0])
return 2
}
}
=== the generator that asks the binary for a verb it does not have ===
96: [scans]="scans push"
133:# above can legitimately emit the same argv twice — ARGV_FOR names `scans push`
the reference documents a non-existent verb, and the drift gate stays green because it compares the generator's output to itselfI inspected the dispatcher, generator, and committed documentation. runScans in cmd/corral/scans.go dispatches only list and show. scripts/gen-cli-docs.sh maps scans to `scans push`, while docs/cli/corral.md contains a `corral scans push` section whose body is the unknown-subcommand error. The generator's own comments do not supply a real push implementation or reject this erroneous help capture.
confirmed by pdbethke — real, reproduced: the CLI reference documents scans push, a verb the dispatcher does not have, with its error as the body
ref 8377ae6320ccf8473acde31eed5b23c5fe7c21b41986b53bed2b18027756a65a#R4
`corral review show` and `corral review plan` apply neither retraction filtering nor LiveEntries, so a retracted review is printed in full by `show` and still counts in `plan` as a scope that has been reviewed — making a withdrawn round look like coverage the planner should skip.
I traced both paths. runReviewShow in cmd/corral/review.go passes all raw entries to FindReview and does not reject a hash present in auditpush.Retracted. runReviewPlan in cmd/corral/review_plan.go likewise iterates every raw KindReview entry into its reviews slice before calling review.Plan. Neither path invokes LiveEntries or otherwise filters retracted review hashes.
confirmed by pdbethke — real, read: review show prints a retracted review in full and review plan counts it as coverage
ref 8377ae6320ccf8473acde31eed5b23c5fe7c21b41986b53bed2b18027756a65a#R5
`corral review --attest` discards the error from writeSignedStatementEnvelope and decides whether to print "signed into <path>" by stat-ing the envelope path, so a leftover envelope from an earlier run (or any unrelated file at that name) makes the run announce that this statement was signed when no signature was produced for it.
I followed the complete signing path. writeReviewStatement in cmd/corral/review.go writes the plain statement, calls writeSignedStatementEnvelope, and explicitly discards both return values. runReviewRun then calls os.Stat on the deterministic `.dsse.json` path and reports `signed into` whenever anything already exists there. writeSignedStatementEnvelope returns errors for absent keys, signing failures, and envelope write failures, so a pre-existing envelope can survive any of those failures and trigger the false message.
confirmed by pdbethke — real, read: --attest decides 'signed' by stat-ing the envelope path and discards the signer's error
ref 8377ae6320ccf8473acde31eed5b23c5fe7c21b41986b53bed2b18027756a65a#R6
`corral scans show -h` never reaches a usage path: the scan id is parsed from args[0] before the flag set exists, so asking what the verb does answers `"-h" is not a scan id` with exit 2 and never prints --evidence/--timing/--json/--ledger.
I traced `corral scans show -h`: runScans recognizes `show` and passes `[-h]` to runScansShow. That function checks only for zero arguments, then calls strconv.ParseInt on args[0] before creating its FlagSet. Consequently `-h` takes the not-a-scan-id branch and the declarations for --ledger, --json, --evidence, and --timing are never reached.
confirmed by pdbethke — real, read: scans show -h never reaches usage; the id is parsed before the flag set exists
ref 8377ae6320ccf8473acde31eed5b23c5fe7c21b41986b53bed2b18027756a65a#R7
Recorded so that "found nothing here" can be told apart from "never looked here".
This is a codebase whose comments are unusually good at describing rules it then fails to enforce at every door — which is exactly where I looked. The `sealRow` type carries a paragraph explaining that `TS` is the PUSH time and `AuditedAt` is when the scan actually ran, and `auditedLabel` honours that for the terminal table; the `--json` door labels the push time `"audited"` and never reads `AuditedAt` at all (1). The same struct's doc explains that the honesty flags were once "dropped on the way to the terminal, so '5 survivors / 0 proven' read as 'tried and proved nothing'" — that was fixed for the terminal and is still true of `--json` (2). `auditpush.LiveEntries` exists specifically because "a retraction used to reach scan entries only, so a retracted review's rows and findings still loaded into the view"; `corral ui` reads raw entries and renders a retracted review as a live one, and only scan entries get the RETRACTED note (3), while `review show` and `review plan` skip the same filter (4). The generated CLI reference — which the repo gates for drift — ships a section documenting `corral scans push`, a verb the dispatcher does not have, whose entire body is the error message that verb produces (5); the drift gate is green because it compares the generator's output to itself, which is the enumeration failure this repo has already written three memos about. Finding 6 is the one place I found a false claim in the run's own transcript: `corral review --attest` decides whether to print "signed into <path>" by stat-ing the envelope path, discarding the signing error, so a stale envelope from an earlier run makes the run announce a signature it did not produce. Findings 1-3 and 5 are reproduced; 4 and 6 are argued from the code only.
R1 stands: the repository-scoped JSON serializer uses TS while the text path uses AuditedAt. R2 stands: the flattened JSON shape omits all three caveat fields and any derived caveat. R3 stands: the UI computes the retraction map but applies it only to scan rows, while still appending retracted reviews and their findings. R4 stands: the generator explicitly substitutes `scans push`, and the committed reference contains the resulting unknown-subcommand response. R5 stands: both show and plan consume raw entries without excluding retracted reviews. R6 stands: envelope creation errors are discarded and the success label is inferred from path existence, allowing a stale envelope to cause a false signing claim. R7 stands: `-h` is parsed as the scan ID before the show flag set is constructed.