d6g8k5htny-coder · Oct 6, 2026
@@ -8,6 +8,9 @@ name: C6 cluster-law checks
       - 'tools/legacy_json_replay.py'
       - 'tools/legacy_json_contracts.json'
       - 'tests/test_legacy_json_workflows.py'
+      - 'tools/**'
+      - 'tools.py'
+      - 'tests/test_legacy_workflow_triggers.py'
   workflow_dispatch:
 
 permissions:
@@ -24,6 +27,10 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Check legacy import-resolution trigger coverage
+        run: |
+          python -B -S tests/test_legacy_workflow_triggers.py
+          python -B -O -S tests/test_legacy_workflow_triggers.py
       - name: Exercise the complete shell rejection contract in both modes
         env:
           LEGACY_TEST_FAMILY: 'c6-cluster'

@@ -8,6 +8,9 @@ name: Far elder rate exact controls
       - 'tools/legacy_json_replay.py'
       - 'tools/legacy_json_contracts.json'
       - 'tests/test_legacy_json_workflows.py'
+      - 'tools/**'
+      - 'tools.py'
+      - 'tests/test_legacy_workflow_triggers.py'
   workflow_dispatch:
 
 permissions:
@@ -24,6 +27,10 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Check legacy import-resolution trigger coverage
+        run: |
+          python -B -S tests/test_legacy_workflow_triggers.py
+          python -B -O -S tests/test_legacy_workflow_triggers.py
       - name: Exercise the complete shell rejection contract in both modes
         env:
           LEGACY_TEST_FAMILY: 'far-elder'

@@ -8,6 +8,9 @@ name: Local pairing exact controls
       - 'tools/legacy_json_replay.py'
       - 'tools/legacy_json_contracts.json'
       - 'tests/test_legacy_json_workflows.py'
+      - 'tools/**'
+      - 'tools.py'
+      - 'tests/test_legacy_workflow_triggers.py'
   workflow_dispatch:
 
 permissions:
@@ -24,6 +27,10 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.11.16'
+      - name: Check legacy import-resolution trigger coverage
+        run: |
+          python -B -S tests/test_legacy_workflow_triggers.py
+          python -B -O -S tests/test_legacy_workflow_triggers.py
       - name: Exercise the complete shell rejection contract in both modes
         env:
           LEGACY_TEST_FAMILY: 'local-pairing'

@@ -0,0 +1,99 @@
+# Legacy package-resolution trigger coverage
+
+Dylan Roy — delegated AI engineering. Actual author OpenAI / GPT-6 Astra Pro,
+`qs-continuation-legacy-trigger-20261006-r6`. Pickup Math-#351/6014859323.
+Scientific effect **NONE**; organizational-independence credit 0. No self-merge.
+
+## Finding and isolated scope
+
+Native #351 discussion_r4191758835 identifies two repository paths which can
+change the meaning of `from tools.legacy_json_replay import replay` without
+matching any of the three dedicated workflow filters: `tools/__init__.py` and
+root `tools.py`. The original helper lives in an implicit namespace package.
+An initializer executes on import; a root module can supersede that namespace
+and make the submodule import fail. This is missing trigger coverage, not a
+claim that the current numerical result is wrong or that a malicious file exists.
+
+Base: #351 head `18afecd9e505167b6eb1d9457b17ed9aacee6677`.
+This proposal changes only three workflows, adds one regression file, and this
+scope note. It is stacked to isolate its delta, NOT permission to merge into
+#351's or #330's owner branch. Canonical parent adoption stays with that owner.
+
+Each workflow retains every original path and adds `tools/**`, `tools.py`, and
+`tests/test_legacy_workflow_triggers.py`. The broad subtree intentionally runs
+these checks for additional tools changes; it does NOT cover root `tools.py`,
+which is therefore explicit. A separate step runs the regression in normal and
+optimized Python before the existing full-shell protocol tests. No negative
+path patterns, new events, permissions, action/runtime pins, job budgets,
+production imports, numerical commands, or acceptance contracts are changed.
+
+The entire original workflow is recovered by removing exactly the three added
+path entries and the four-line new step. The original source preflight,
+checker/replay invocation, final JSON statement and Git postflight are byte-exact.
+All helper/contracts, original tests, scientific inputs/proofs/RESULTS/manifests,
+formal code, scientific registers, premises and review history are unchanged.
+
+## Test-first execution
+
+Local: CPython 3.13.5, Git 2.47.3, Linux. GitHub clone failed DNS, so the local
+worktree is an authenticated three-file source subset, not a full repository.
+All original workflow bytes reconstruct their native Git blob identities:
+
+| Workflow | Original Git blob |
+|---|---|
+| local-pairing.yml | 8ea45e74672c42687176462e79df33adaf83c98d |
+| far-elder-rate.yml | 37c0dd197e3d6c0fd10a172a656b79f496943aa2 |
+| c6-cluster-law.yml | ae5bf02b6358c0e83fe8a52b470eb4734536f113 |
+
+The five-method new suite against the original workflows fails **15 intended
+assertions per outer interpreter mode, zero errors**: nine named resolver-path
+coverage cases, three missing self-triggers and three missing two-mode steps.
+The actual-import method passes even on the predecessor, establishing the
+mechanism independently of the repaired configuration. It executes the exact
+import line read from each workflow against a synthetic helper in isolated
+subprocesses: three families, two child modes, namespace/initializer/root-module
+variants, **18 real children per outer run**. Initializers and root modules leave
+observable markers; root-module selection also yields the expected package error.
+No import/subprocess implementation is mocked. Child environments are private
+and remove ambient PYTHON variables; the caller environment is not changed.
+
+After the 21-line workflow amendment, **5/5 methods pass in each outer mode**.
+Four separately copied configuration mutations then reject in both modes with
+exactly 3/6/3/3 assertion failures and zero errors: remove root-module coverage,
+remove subtree coverage, remove the test's trigger, or remove its optimized
+invocation. Valid old paths and unrelated-path negatives are retained. All three
+YAML documents parse and every run block passes `bash -n`; the product test itself
+uses only the standard library, not the auxiliary YAML inspection dependency.
+
+From the repository root:
+
+```sh
+python -B -S tests/test_legacy_workflow_triggers.py
+python -B -O -S tests/test_legacy_workflow_triggers.py
+```
+
+## Evidence and integration boundaries
+
+The test uses a deliberately restricted reader for the actual positive,
+single-quoted path lists, and literal/subtree patterns. It rejects unsupported
+syntax rather than claiming to implement GitHub's full YAML/glob evaluator.
+These checks establish configured coverage and real Python import behavior;
+they do NOT constitute a hosted changed-path-only scheduling experiment, a
+hostile-source sandbox, an exhaustive import-dependency audit, or a theorem.
+GitHub's own changed-file/diff limits remain. Arbitrary future loader hooks,
+root standard-library shadows and installed dependencies are outside this fix.
+
+Full original legacy tests and source-authenticated numerical replays were not
+executed locally. Actual dedicated and applicable general hosted checks on the
+published candidate, a bounded nonauthor delta review, and an explicit owner
+adoption/reconciliation are still required. No earlier #330/#351 review transfers
+to changed YAML merely because the numerical block is preserved. Keep the native
+finding open until its actual source/review disposition is satisfied. A stacked
+success is not a current-main integration receipt. Parent and later #348/signing
+branches must not be overwritten; reconcile their real ordering and source.
+
+Primary technical references consulted 2026-10-06:
+- https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
+  (`on.<event>.paths`, diff limits, literal and `**` path patterns).
+- https://docs.python.org/3.13/reference/import.html
+  (regular/namespace packages and submodule import resolution).
@@ -0,0 +1,138 @@
+"""Named legacy import-resolution triggers; real imports, not a GitHub scheduler.
+
+The loader below intentionally accepts only these workflows' simple, positive,
+single-quoted path lists and literal/prefix/** patterns. Unsupported syntax fails
+rather than pretending to implement the general GitHub glob/YAML language.
+Synthetic helper bodies demonstrate resolution only, not numerical correctness.
+"""
+from pathlib import Path
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+SELF = 'tests/test_legacy_workflow_triggers.py'
+FAMILIES = {
+    'local-pairing.yml': 'frontiers/local_pairing_20260930',
+    'far-elder-rate.yml': 'frontiers/far_elder_rate_20260930',
+    'c6-cluster-law.yml': 'frontiers/c6_cluster_law_20260929',
+}
+STEP = (
+    '      - name: Check legacy import-resolution trigger coverage\n'
+    '        run: |\n'
+    '          python -B -S ' + SELF + '\n'
+    '          python -B -O -S ' + SELF + '\n'
+)
+
+
+def workflow_text(name):
+    return (ROOT / '.github' / 'workflows' / name).read_text(encoding='utf-8')
+
+
+def trigger_paths(text):
+    start = "'on':\n  pull_request:\n    paths:\n"
+    if text.count(start) != 1:
+        raise ValueError('expected one plain pull-request path list')
+    rows = text.split(start, 1)[1].split('  workflow_dispatch:\n', 1)
+    if len(rows) != 2:
+        raise ValueError('expected workflow-dispatch after path list')
+    found = []
+    for line in rows[0].splitlines():
+        match = re.fullmatch(r"      - '([^']+)'", line)
+        if not match or match[1].startswith('!'):
+            raise ValueError('unsupported path-list syntax')
+        pattern = match[1]
+        plain = pattern[:-3] if pattern.endswith('/**') else pattern
+        if any(c in plain for c in '*?[]{}!'):
+            raise ValueError('unsupported path pattern')
+        found.append(pattern)
+    if not found or len(found) != len(set(found)):
+        raise ValueError('empty or duplicate path list')
+    return found
+
+
+def covered(patterns, path):
+    # Only literal names or whole subtrees, as validated by trigger_paths.
+    return any(path.startswith(p[:-2]) if p.endswith('/**') else path == p
+               for p in patterns)
+
+
+class LegacyTriggerTests(unittest.TestCase):
+    def test_package_and_root_module_changes_are_covered(self):
+        for name in FAMILIES:
+            paths = trigger_paths(workflow_text(name))
+            for path in ('tools/__init__.py', 'tools.py', 'tools/nested/input.py'):
+                with self.subTest(workflow=name, path=path):
+                    self.assertTrue(covered(paths, path), 'resolver change lacks replay trigger')
+
+    def test_original_paths_and_new_regression_remain_covered(self):
+        for name, packet in FAMILIES.items():
+            paths = trigger_paths(workflow_text(name))
+            for path in (packet + '/checker.py', '.github/workflows/' + name,
+                         'tools/legacy_json_replay.py', 'tools/legacy_json_contracts.json',
+                         'tests/test_legacy_json_workflows.py', SELF):
+                with self.subTest(workflow=name, path=path):
+                    self.assertTrue(covered(paths, path), 'consumed or regression path is uncovered')
+            for path in ('README.md', 'unrelated/tools.py', 'tools_extra/file.py'):
+                with self.subTest(workflow=name, unrelated=path):
+                    self.assertFalse(covered(paths, path), 'unexpected unrelated trigger')
+
+    def test_new_checks_run_in_both_modes_before_existing_replay(self):
+        for name in FAMILIES:
+            text = workflow_text(name)
+            with self.subTest(workflow=name):
+                self.assertEqual(text.count(STEP), 1, 'missing exact two-mode trigger-test step')
+                self.assertLess(text.index(STEP), text.index(
+                    '      - name: Exercise the complete shell rejection contract in both modes\n'))
+
+    def test_original_import_actually_uses_both_resolver_inputs(self):
+        for name in FAMILIES:
+            lines = [s.strip() for s in workflow_text(name).splitlines()
+                     if s.strip().startswith('from tools.')]
+            self.assertEqual(lines, ['from tools.legacy_json_replay import replay'])
+            program = lines[0] + "\nprint(replay())\n"
+            for flags in (['-B', '-S'], ['-B', '-O', '-S']):
+                for variant in ('namespace', 'initializer', 'root-module'):
+                    with self.subTest(workflow=name, flags=flags, variant=variant), \
+                            tempfile.TemporaryDirectory() as directory:
+                        root = Path(directory)
+                        (root / 'tools').mkdir()
+                        (root / 'tools/legacy_json_replay.py').write_text(
+                            "def replay(): return 'SYNTHETIC_HELPER'\n", encoding='utf-8')
+                        if variant != 'namespace':
+                            target = ('tools/__init__.py' if variant == 'initializer'
+                                      else 'tools.py')
+                            (root / target).write_text(
+                                "from pathlib import Path\n"
+                                "Path('resolver.marker').write_text('executed')\n",
+                                encoding='utf-8')
+                        # Private process environment; do not alter caller configuration.
+                        env = {k: v for k, v in os.environ.items() if not k.startswith('PYTHON')}
+                        child = subprocess.run([sys.executable, *flags, '-'], input=program.encode(),
+                                               cwd=root, env=env, capture_output=True, timeout=10)
+                        marker = root / 'resolver.marker'
+                        self.assertEqual(marker.exists(), variant != 'namespace')
+                        if marker.exists():
+                            self.assertEqual(marker.read_text(), 'executed')
+                        if variant == 'root-module':
+                            self.assertEqual(child.returncode, 1)
+                            self.assertEqual(child.stdout, b'')
+                            self.assertIn(b'ModuleNotFoundError', child.stderr)
+                            self.assertIn(b"'tools' is not a package", child.stderr)
+                        else:
+                            self.assertEqual((child.returncode, child.stdout, child.stderr),
+                                             (0, b'SYNTHETIC_HELPER\n', b''))
+
+    def test_limited_path_reader_rejects_unsupported_syntax(self):
+        template = "'on':\n  pull_request:\n    paths:\n%s  workflow_dispatch:\n"
+        for rows in ("      - '!tools.py'\n", "      - tools.py\n",
+                     "      - 'tools.*'\n", "      - 'tools.py'\n      - 'tools.py'\n", ''):
+            with self.subTest(rows=rows), self.assertRaises(ValueError):
+                trigger_paths(template % rows)
+
+
+if __name__ == '__main__':
+    unittest.main()