Development record
2026-08-26 — Bug-hunt round 8 (bughunt-a, state #368): baseline green; five
2026-08-26 — Bug-hunt round 8 (bughunt-a, state #368): baseline green; five
parallel Opus 4.8 hunters across the four dimensions, each candidate
adversarially refuted by a fresh independent subagent. 9 substantive confirmed
and fixed, 3 refuted as prior art/design. Code: iss-2608261206490430 — the
disembark scan fell open to a wide read on an all-ignored repository (an empty
ls-files listing was conflated with a git failure; now parted, with a
watched-fail test). Infra: iss-2608261206505385 — site check ran in no gate
before a release published, so a check-only trip failed after the binaries
shipped (now run in the Makefile site-render recipe and the ci.yml step);
iss-2608261206507510 — RS001 unioned its leaves-open and enters-closed id sets,
so a bare git rm of an open record satisfied a Resolves trailer while the
record vanished from the ledger — corrected to require the id to ENTER a
terminal folder (the refuter's intersect recommendation would have broken
fresh-capture-and-resolve in the same PR; caught and verified before shipping).
Docs/record: iss-2608261206491486 — disembark's .gitignore guarantee scoped to
the free-text tree scan, since pack copies declared records verbatim regardless;
iss-2608261206506035 / iss-2608261206505136 / iss-2608261206508851 — the
shipped/ intent-auditor entry precondition, the roadmap Planned spec-link claim,
and the surface contract's "shipped/ is empty" all corrected to the close-only
lifecycle (20/43 planned intents legally hold spec_id null; shipped/ holds 18);
iss-2608261206504574 — CONTRIBUTING repointed from the hand-written CHANGELOG
flow to the derived one; iss-2608261206504710 — eleven live brief citations
moved from the retired adr-18 to its successor adr-28. Refuted: the
ScrubbedEnv/GIT_CONFIG_GLOBAL candidate (already adjudicated round 5), install.md
SessionStart stderr (deferred iss-2608251011427187 / open iss-253), and the
submodule-walk drop (aligned with the vendor-skip design; iss-133 wording
family). nitpicks-only: no.
Frontmatter
| id | dcn-2608260000000004 |
|---|---|
| type | decision |
| date | 2026-08-26 |
.abcd/work/decisions/dcn-2608260000000004-bug-hunt-round-8-bughunt-a-state-368.md
open on GitHub ↗ · commit history ↗
mentions13
- adr-28One repository, a curated release artifact — no dev→public mirror
- iss-133the probe adapters' truncation message says the rest of the tree was not walked, but the per-directory read bound added for iss-112 can set truncated while the walk completed everything else; the over-warning is in the conservative direction, not a loud-staging violation, but the message is imprecise about WHAT was truncated
- iss-253The Cut A §4 manual gate FAILED on assertions 3 and 4 (transcript: .abcd/.work.local/scratch/2026-08-16-s4-transcript.txt, machine: a no-Go Mac with a fresh harness install). After /plugin marketplace add + /plugin install, NO bootstrap line ever appeared at any of three session starts, the plugin root (…/plugins/cache/abcd-marketplace/abcd/<sha>/) contained a full source checkout but no provisioned binary, and every UserPromptSubmit and PreToolUse hook errored 'No such file or directory' for the entire evening — the exact failure family the gate checks for zero of. The command surface functioned only via rung two (the PATH binary the separate one-liner installed), so the no-Go promise is unproven; ahoy install itself reports plugin.root_missing as resolvable:false. Assertions 1, 2 and 5 passed (checksum-verified one-liner with no sudo, abcd v0.5.0; transcript captured; non-interactive install with a clean, path-scrubbed receipt — including a correct abort in a non-repo directory). Per the gate's own rule this BLOCKS Cut B. Environment notes for reproduction: the harness never visibly ran the plugin's SessionStart chain after install (bootstrap.sh emitted nothing — neither success nor refusal, despite loud-staging), and the machine's home dirs are cloud-synced (anomalous stat results, 65535 link counts, multi-minute tree walks in the clone). Detector: the §4 checklist; acceptance: a fresh-machine plugin install yields one bootstrap success line, a provisioned plugin-root binary, and /abcd answering in about a second with no Go.
- iss-2608251011427187hooks/bootstrap.sh and hooks.json still deliver SessionStart notices by a non-zero exit, which the harness renders as an opaque banner with the text dropped. iss-2608241115201044 fixed the binary half: abcd hook session-start now exits 0, writes its notice text to stderr and only a CONSTANT to stdout. The shell half is unchanged and inconsistent with it. bootstrap.sh's notice() exits 2 on a REPORTED CONDITION including a successful install, and hooks.json's SessionStart chain propagates that ($s) plus a trailing exit 2 on the missing-binary branch. Under the same premise those messages are dropped too, so a fresh install's success line and the missing-binary complaint are both delivered by the mechanism the binary half abandoned. bootstrap.sh's own comment states the reasoning that makes the binary fix correct — 'a SessionStart hook's stdout becomes model context' — and an adversarial review demonstrated that concern concretely, planting a directive payload in a TRACKED config value that reached context when notices were briefly routed to stdout. So the shell must NOT simply move its text to stdout either. The open question is what channel a shell hook has left: a constant on stdout plus text on stderr mirrors the binary, but bootstrap.sh's exit code also governs the install path, and changing it touches the most safety-critical surface in the repo. Deliberately deferred rather than bundled into the binary fix.
- iss-2608261206490430disembark scan fails open to a wide read on an all-ignored repository
- iss-2608261206491486disembark docs claim all three verbs honour gitignore but only the tree scan does
- iss-2608261206504574CONTRIBUTING teaches the hand-written CHANGELOG flow the release derivation fails closed on
- iss-2608261206504710the brief grounds the live licence gate in the retired adr-18 at eleven sites
- iss-2608261206505136roadmap Planned row claims a linked spec but planned intents legally hold spec_id null
- iss-2608261206505385site check runs in no gate before the release publishes
- iss-2608261206506035shipped intent docs claim intent-auditor ran as an entry precondition it does not gate
- iss-2608261206507510RS001 admits a bare delete of an open record as a declared resolution
- iss-2608261206508851the intent surface contract still calls shipped empty while it holds intents