ltl-accumulator-verified/verification
mrwulf a0d11b44d9 verification: lifted phases run under the buttons shell options, enforced in lift-guard
A lift is evidence about the shipping gate only if it executes the way the
shipping gate executes. Every button here runs `set -euo pipefail`. Eighteen
lift sites prefixed their driver with `set -uo pipefail` and no -e — four per
fork (selftest-harness, selftest-scalar-statements, selftest-statements twice)
and both accumulator lifts — while sixteen other sites got it right. The estate
did it both ways, which is what made this a defect and not a convention.

Without -e a failing command does not abort: execution continues and the driver
returns the LAST command status. A lifted phase can therefore reach a verdict
the shipping phase would never reach while the self-test reports the gate
"works". selftest_statements.sh:27 claims the tested logic IS the shipping
logic; in this respect it was not.

NO VERDICT CHANGED. Every self-test that passed before passes now, at the same
timings, so -e was not masking a false green at these commits. The defect was
fidelity and the claim is no larger than that.

The durable part is not the 18 edits. lift-guard.sh already inspects every
driver, so it now REFUSES any lift whose driver does not enable errexit and
prints the drivers actual shell options. Negative-tested four ways: no -e
rejects, `set -euo` passes, bare `set -e` passes, no set line at all rejects.
Byte-identical across the four forks. The nineteenth lift someone writes fails
closed rather than silently testing a more permissive shell.

Certified by the round-15 sweep: 50/50 GREEN, six repositories, both buttons
and every self-test, exit 0.

Registered and NOT fixed here: ltl-accumulator-verified has no lift-guard.sh
at all and calls it zero times, so its two lifts remain unguarded — the one
place this class can still recur silently.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-04 12:58:29 +02:00
..
fidelity accumulator: a run that is not attestation-ready must not exit 0, and must name its subject 2026-08-02 21:40:35 +02:00
gen/LTLAcc revision round 1: address both external reviews (GPT-5.6 + second Claude) 2026-07-11 22:53:47 +02:00
Proofs audit: bind the scalar statements, and make the accounting identity mean audit 2026-08-03 12:15:26 +02:00
AUDIT-MANIFEST.txt verification: bind statements and specification bodies (P1-a); un-stale the fidelity pin 2026-07-29 09:07:13 +02:00
check.sh verification: separate the two accounting questions (round-9 review, Claude N2) 2026-08-04 03:17:05 +02:00
driver-allowlist.txt audit: bind the scalar statements, and make the accounting identity mean audit 2026-08-03 12:15:26 +02:00
HARNESS.sha256 verification: lifted phases run under the buttons shell options, enforced in lift-guard 2026-08-04 12:58:29 +02:00
inventory-allowlist.txt Review round 4: F1* absorbed (lied-size boundary), acceptCons_sound, kit reproducibility 2026-07-12 15:07:57 +02:00
inventory_gate.sh audit: bind the scalar statements, and make the accounting identity mean audit 2026-08-03 12:15:26 +02:00
lean-guard L1+L2: hashing shapes, domain separation, MTH/Root/ConsRec with termination 2026-07-10 23:58:00 +02:00
lean-toolchain Review round 4: F1* absorbed (lied-size boundary), acceptCons_sound, kit reproducibility 2026-07-12 15:07:57 +02:00
PACTA-PIN.sha256 accumulator: a run that is not attestation-ready must not exit 0, and must name its subject 2026-08-02 21:40:35 +02:00
run_bare.sh Round 5 (housekeeping): doc-consistency welded into the button; both round-4 approvals recorded 2026-07-15 09:40:20 +02:00
selftest-harness.sh verification: lifted phases run under the buttons shell options, enforced in lift-guard 2026-08-04 12:58:29 +02:00
selftest_audit.sh Round-7 F2: account for every constant the kernel sees 2026-08-02 02:51:55 +02:00
selftest_statements.sh verification: lifted phases run under the buttons shell options, enforced in lift-guard 2026-08-04 12:58:29 +02:00