Adversarial re-verification of the gate itself found three holes.
The disposition check matched the finding's verdict anywhere in the table
row, and every row also carries the prior verdict — so `| NS-01 | PARTIAL
| FIXED |` satisfied a receipt that said either. It now reads the
disposition from its own column, which is the check the gate was supposed
to be performing all along.
An evidence path only had to exist. A row could point at an unrelated
suite and look substantiated, so each evidence file must now name the
finding it is evidence for; rows the review labelled differently declare
their own markers rather than the check being loosened.
The file-transfer bundle budget was a number typed into prose next to a
number in config, which is exactly the evidence drift the cross-audit
raised. The gate now compares them.
Each hole was confirmed by breaking the input and watching the gate fail:
a disposition disagreement, a budget changed to 60,000, and NS-07 pointed
at the public cache suite.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The ledger declared "All 38 are now FIXED" while six of those rows were
reproducibly partial. A summary sentence is cheap and a reviewer reads it
as evidence, so the claim is now derived from a machine-readable record:
`docs/operations/adapter-remediation-dispositions.json` carries each
finding's disposition and the test paths that hold it, and
`check:remediation-ledger` joins that file to the prose, verifies every
evidence path exists, and refuses a blanket closure sentence while any row
is still open.
The shared-abort gate had the same weakness in miniature: it passed when
at least one production file imported the primitive, so an unrelated
import satisfied it while Image and Resumable kept their own diverging
copies. It now requires the four named consumers to resolve their import
to the primitive itself, and prints the exact importer set rather than a
count.
`check:optional-recipes:source` was already failing before this work
(52,078 against a 52,000 budget) and the correctness code above pushed it
further. Duplicate abort mechanics were consolidated first — Image and
Resumable onto the shared primitive, four decoders onto one snapshot
helper — and the remainder is code the review asked for, so the budget is
reset to 54,600 against a measured 53,810 with that reasoning recorded,
rather than the failure being carried forward as if it were green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
