From b1138710e4db54814c48a8b91a5c8b88d6a990a6 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Sun, 19 Jul 2026 08:44:11 +0800 Subject: [PATCH 1/3] =?UTF-8?q?operational-rigor=20=C2=A74:=20an=20interac?= =?UTF-8?q?tive=20path=20is=20unverified=20until=20driven=20in=20its=20run?= =?UTF-8?q?time?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Client-runtime behavior that turns on framework identity or lifecycle (callback identity across renders, ref mount/unmount timing, effect dependency capture) can pass every local gate AND a cross-family diff review yet break only once deployed — the fault lives in runtime interaction the static artifact never exercises, so a green build, clean diff, and passing unit tests are all silent on it. Names the class as a §4 rule (the existing "verify by execution; if impossible say what to run" covers the principle but not this class), with the honest disclosure: treat a freshly-shipped interactive path as unverified until driven where it runs. Provenance: generalizes a private production incident (contributor-reported shape); ships `unprobed` — the pack's private fixtures have no interactive arm (cf. the grill-pass note). Marker records the debt, not an exemption. Co-Authored-By: Claude Fable 5 --- skills/operational-rigor/SKILL.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index fb9bd6d..6636450 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -272,6 +272,21 @@ When rigor conflicts with finishing sooner, rigor wins. change: confirm the override, then bring the spec along with the code. - Verify by execution wherever possible. If impossible, say so and state what the user must run. +- **An interactive or client-runtime path is unverified until driven in its real + runtime** (`unprobed` — private incident as shape; see Provenance). Client + behavior that turns on framework identity or lifecycle — a callback's stable + identity across renders, a ref's mount/unmount timing, an effect's dependency + capture — can pass every static gate (unit tests, the build, a cross-family + review of the diff) and still break in a way none of them can surface, because + the fault lives in runtime interaction the static artifact never exercises. A + green build, a clean diff, and passing unit tests are all silent on it — only + exercising the path in its real runtime surfaces the fault. Treat a freshly- + shipped interactive path as unverified until it has been driven where it runs + (a browser e2e gate, a real click, a real navigation, the real deploy target), + and disclose that repro limit rather than reporting it verified. + ✅ "the new toggle handler is shipped but unverified until I drive it in the + deployed UI." ❌ "the handler's diff reviewed clean and its unit tests pass, so + the interaction works." - Confirm mutating effects from system responses, not command intent. Exit code 0 is evidence; "issued" is not. - Do not conflate **runs** (no crash), **passes** (checks green), and **correct** @@ -507,6 +522,13 @@ treats leftover debris as a fraud signal). All three ship `unprobed` in-house per the covenant; the private suite's fixtures could probe each (scope expansion, memory-picked file paths, scratch litter) — none has run; the markers record that debt. +The §4 interactive-runtime rule (2026-07-19) generalizes a private production +incident: a client callback-identity/lifecycle bug survived the full local gate +suite and a cross-family review of the diff, surfacing only when a user drove +the deployed path (contributor-reported shape; the private repo is verifiable by +the contributor, not linkable here). It ships `unprobed` — the pack's private +fixtures have no interactive arm to drive it (cf. the grill-pass note above); the +marker records that debt, not an exemption. Stable behavioral rules; the environment-specific facts to re-verify now travel with the rules that cite them — the external-systems set in `references/external-systems.md`, plus §2's mount-check commands From 596cd58a640858c1794b5223cf68ec989c848f94 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Mon, 20 Jul 2026 17:12:40 +0800 Subject: [PATCH 2/3] operational-rigor: tighten the interactive-runtime rule per dual-model xcheck MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses grok-4.5 (high) + gpt-5.6-sol (max) review of firaen22's rule. Both families independently flagged the same merge-blocker: the done-condition was dual-armed (drive OR disclose) but only the ✅ modeled the disclose arm and the body never ordered the arms like parent §4 - a weak model could ship+disclaimer without driving even when a runtime was reachable. Fixes, all reproduced against the file's own doctrine: - Order the duty to §4's execute-or-say: drive the relevant lifecycle sequence (re-render/mount-unmount/dep-change) in a faithful runtime and observe the result when one is reachable; disclosure is the fallback ONLY when it is not. - Rewrite ✅ to show drive+observe (was: a bare disclosure); ❌ now covers both unit-green-so-works AND disclosed-when-a-runtime-was-reachable. - Soften the overstated absolute (gpt FIX-1 / grok nit): 'every static gate / none can surface / only real runtime' was false - a re-render component test or a dependency lint catches SOME; the true claim is a gate that does not exercise the transition cannot establish it. - Wording: 'depends on' not 'turns on'; 'new or changed' not 'freshly-shipped'; a local runtime example instead of 'deploy target' (that bleeds into external-systems); one-way cross-ref to delegation-and-review §3 unit-green so a later editor won't merge the homes. Runtime examples kept brand-generic per skill-authoring §6. unprobed marker + Provenance unchanged (still accurate under the softened claim). Word-diff audited vs b113871: zero unintended dropped clauses. Local checks green. Co-Authored-By: Claude Fable 5 --- skills/operational-rigor/SKILL.md | 36 ++++++++++++++++++------------- 1 file changed, 21 insertions(+), 15 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 6636450..df617be 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -272,21 +272,27 @@ When rigor conflicts with finishing sooner, rigor wins. change: confirm the override, then bring the spec along with the code. - Verify by execution wherever possible. If impossible, say so and state what the user must run. -- **An interactive or client-runtime path is unverified until driven in its real - runtime** (`unprobed` — private incident as shape; see Provenance). Client - behavior that turns on framework identity or lifecycle — a callback's stable - identity across renders, a ref's mount/unmount timing, an effect's dependency - capture — can pass every static gate (unit tests, the build, a cross-family - review of the diff) and still break in a way none of them can surface, because - the fault lives in runtime interaction the static artifact never exercises. A - green build, a clean diff, and passing unit tests are all silent on it — only - exercising the path in its real runtime surfaces the fault. Treat a freshly- - shipped interactive path as unverified until it has been driven where it runs - (a browser e2e gate, a real click, a real navigation, the real deploy target), - and disclose that repro limit rather than reporting it verified. - ✅ "the new toggle handler is shipped but unverified until I drive it in the - deployed UI." ❌ "the handler's diff reviewed clean and its unit tests pass, so - the interaction works." +- **A new or changed interactive/client path whose correctness depends on + runtime identity or lifecycle is unverified until that transition is driven + and its result observed** (`unprobed` — private incident as shape; see + Provenance). The class: a callback's identity across renders, a ref's + mount/unmount timing, an effect's dependency capture. A gate that never + exercises the transition cannot establish it — the build, a clean diff, and + tests that don't drive it stay silent; a re-render+event component test or a + dependency lint catches SOME, which is exactly the point (exercise the + transition; don't take a green static artifact as its stand-in). Duty keeps + the execute-or-say ordering above: when a faithful runtime is reachable — a + browser e2e gate, a dev UI, or an in-process render harness running the real + framework, usually a local one — drive the relevant sequence (re-render then + invoke, mount/unmount/remount, change the dependency) and observe the + expected result; fall back to disclosing it unverified and naming what the + user must run ONLY when no faithful runtime is reachable. Distinct from + delegation-and-review §3's unit-green seam-bypass (a wiring defect); this is + the runtime the static artifact never ran. + ✅ "re-rendered after the parent changed, clicked the toggle, watched the + handler read the current value, not a captured one." + ❌ "diff's clean and unit tests pass, so the interaction works" — or + "disclosed as unverified" when a dev server was one command away. - Confirm mutating effects from system responses, not command intent. Exit code 0 is evidence; "issued" is not. - Do not conflate **runs** (no crash), **passes** (checks green), and **correct** From 2ebdcd32d5a24a2ae0a8befbfbc278af3ffaffeb Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Mon, 20 Jul 2026 17:18:28 +0800 Subject: [PATCH 3/3] operational-rigor: round-2 refinements to the interactive-runtime rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gpt-5.6-sol (max) round-2 caught two refinements of the round-1 fix (grok round-2 PROCEEDed); both reproduced, non-thrashing: - 'tests that don't drive it stay silent' slipped back toward the absolute the round-1 fix shed: a non-driving test/build may catch OTHER defects, it just can't certify this transition. Reworded to the non-establishment claim ('may catch other defects but can't certify this one'; 'exercise-the-transition, not distrust-every-test'). - The fallback overcorrected: 'disclose ONLY when no faithful runtime is reachable' forbids the legitimate case where a runtime IS reachable but the transition can't be driven (state/credentials/hardware) — which conflicts with parent §4's 'if impossible, say so'. Re-keyed to whether the transition can be driven+observed in any reachable runtime, with the escape hatch still closed ('never merely because a reachable one was skipped' + the ❌ arm). Word-diff scoped to those two spots; ✅/❌ and the unit-green cross-ref (grok-PROCEEDed) untouched. Local checks green. Co-Authored-By: Claude Fable 5 --- skills/operational-rigor/SKILL.md | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index df617be..82300cc 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -278,15 +278,18 @@ When rigor conflicts with finishing sooner, rigor wins. Provenance). The class: a callback's identity across renders, a ref's mount/unmount timing, an effect's dependency capture. A gate that never exercises the transition cannot establish it — the build, a clean diff, and - tests that don't drive it stay silent; a re-render+event component test or a - dependency lint catches SOME, which is exactly the point (exercise the - transition; don't take a green static artifact as its stand-in). Duty keeps - the execute-or-say ordering above: when a faithful runtime is reachable — a - browser e2e gate, a dev UI, or an in-process render harness running the real - framework, usually a local one — drive the relevant sequence (re-render then - invoke, mount/unmount/remount, change the dependency) and observe the - expected result; fall back to disclosing it unverified and naming what the - user must run ONLY when no faithful runtime is reachable. Distinct from + non-driving tests may catch other defects but can't certify this one; a + re-render+event component test or a dependency lint catches SOME, which is + why the rule is exercise-the-transition, not distrust-every-test. Duty keeps + the execute-or-say ordering above: when a faithful runtime can drive and + observe the transition — a browser e2e gate, a dev UI, or an in-process + render harness running the real framework, usually a local one — drive the + relevant sequence (re-render then invoke, mount/unmount/remount, change the + dependency) and observe the expected result; disclose it unverified and name + what the user must run only when the transition genuinely cannot be driven + and observed in any reachable runtime (required state, credentials, or + hardware unavailable), never merely because a reachable one was skipped. + Distinct from delegation-and-review §3's unit-green seam-bypass (a wiring defect); this is the runtime the static artifact never ran. ✅ "re-rendered after the parent changed, clicked the toggle, watched the