vh/booth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(u6): fold the cold contract panel — the import selection gap, and a document arguing with itself

Browse Source 
/heid-contract-review panel 01M35BWCJ806MT75NA630Y4WFH. The headline arrived
from all four arms independently and it is a missing feature, not a wording
problem.

`bench import --apply` registered every candidate, while the same contract says
roughly 14 of 35 are reference bookmarks that must stay on the board. There was
no selection mechanism between the dry-run report and the write -- so the write
path did the exact thing this unit's rationale calls impossible, tell a bench
from a bookmark by its URL, silently, to rows that belong where they are. The
report existed precisely because the decision is not mechanizable. `--apply`
now takes the ids the operator names; a bare `--apply` is refused and an
unknown id is refused, both writing nothing.

Two solo findings, both real:

- A successful registration could push the registry past the size its own
  reader refuses, so the LAST bench added would make every other bench
  invisible while reporting success. The writer now respects the reader's cap.
- The credential ban covered bench URLs and not `booth link`, the door this
  unit did not touch -- and the board renders on an unauthenticated LAN
  surface. A password can no longer reach it through either door. A small
  deliberate widening, named rather than smuggled.

Cap semantics were readable three ways (refuse / clip-for-display /
truncate-and-store) with a different build behind each, 4-of-4. Now stated per
field: name and owner truncate, url and state are refused at the write and are
DAMAGE at the read. url is not a display budget -- INV-7 promises the click
goes to the posted address byte for byte, and a clipped URL keeps that promise
in the type system while breaking it in the browser. The code had been clipping
it; fixed.

Two passages disagreed about one character: INV-7's specimen named "a trailing
slash on a non-empty path" as something normalization changes, while the rule
list keeps it and INV-6 makes the two spellings two benches. The rule list is
right; the specimen was wrong. Found by 3-of-4.

Also: INV-6's component list was illustrative where it had to be exhaustive and
was short scheme and port; "writes nothing" appeared twice with different
lists; the dead marker's predicate was readable two ways with 221 rows riding
on it; and INV-2's falsifier read as though three callers agreeing pinned
something, when three callers of one wrong predicate agree perfectly -- the
table's expected values are the real check and now say so.

597 -> 604 tests.
This commit is contained in:
vh
2026-09-22 14:12:36 -07:00
parent 8a7af3eb08
commit 32e3ed65e1
5 changed files with 351 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/booth
+43 -7
View File
@@ -359,6 +359,19 @@ case "$cmd" in
echo "booth link: the booth check answered something unrecognised; nothing was posted." >&2
exit 3 ;;
esac
# CREDENTIALS DO NOT GO ON THE BOARD, through any door. `normalize_bench_url`
# refuses userinfo for a bench; `booth link` is the door this unit did not
# touch, and the board renders on an unauthenticated LAN surface. A small,
# deliberate widening of the unit -- named rather than smuggled.
case "$link_url" in
*://*@*)
{
echo "booth link: that URL carries credentials (user:pass@host) and the board"
echo " is readable by anyone who can reach this service. Nothing was posted."
echo " strip the credentials and post it again."
} >&2
exit 2 ;;
esac
if [ -n "$refused_name" ]; then
{
echo "booth link: that is a booth, and a booth announces itself now."
@@ -523,6 +536,7 @@ elif sub in ("state", "rm"):
print("%s is now %s" % (moved.url, moved.state))
elif sub == "import":
apply = "--apply" in argv
picked = [a for a in argv if a != "--apply"]
board = root / os.environ["BOOTH_BOARD"] / "links.md"
if not board.is_file(): die("no link board at %s" % board, 1)
skipped, candidates, refused = [], [], []
@@ -554,16 +568,38 @@ elif sub == "import":
print(" %-52s %s" % (e["url"], why))
if not apply:
print()
print("nothing was written. re-run with --apply to register the candidates.")
print("NOTE: a machine cannot tell a bench from a bookmark by its URL —")
print(" roughly 14 of 35 live candidates are repos, model cards and docs,")
print(" for which the board is the right home. Review before applying.")
print("nothing was written.")
print(" booth bench import --apply <id>... register ONLY the ids you name")
print()
print("A MACHINE CANNOT TELL A BENCH FROM A BOOKMARK BY ITS URL. On the live")
print("board roughly 14 of 35 candidates are repos, model cards and docs, for")
print("which the board is the right and only home. So `--apply` takes the ids")
print("YOU pick from the list above; it will not register the whole set.")
raise SystemExit(0)
for i, e in candidates:
# SELECTION IS MANDATORY. A bare `--apply` would do exactly the thing this
# rationale of this very unit says is impossible -- decide bench-vs-bookmark
# URL -- and it would do it silently, to ~14 rows that belong on the board.
# The dry-run prints the ids; the operator names the ones that are benches.
if not picked:
print()
print("booth bench import --apply needs the ids to register.", file=sys.stderr)
print(" nothing was written. copy the ids you want from the list above:",
file=sys.stderr)
print(" booth bench import --apply <id> [<id>...]", file=sys.stderr)
raise SystemExit(2)
by_id = {i: e for i, e in candidates}
unknown = [i for i in picked if i not in by_id]
if unknown:
print()
for i in unknown:
print("not a candidate id: %s" % i, file=sys.stderr)
print("nothing was written.", file=sys.stderr)
raise SystemExit(2)
for i in picked:
e = by_id[i]
upsert_bench(root, e["url"], e["desc"], e["who"] or who)
print()
print("applied: %d distinct benches registered. links.md was NOT modified."
% len({i for i, _ in candidates}))
print("applied: %d bench(es) registered. links.md was NOT modified." % len(set(picked)))
' "$@"
;;
ask)