Claim
scripts/agent-preflight.sh:222-225 guards the trailer check:
# Trailer enforcement reads only committed Git objects.
if git rev-parse --verify -q origin/main >/dev/null 2>&1 &&
git merge-base --is-ancestor origin/main HEAD &&
[ "$(git rev-list --count origin/main..HEAD 2>/dev/null || echo 0)" -gt 0 ]; then
echo "Commit trailers vs origin/main:"
run "commit-trailers" python3 scripts/check-commit-trailers.py --range "origin/main..HEAD"
git merge-base --is-ancestor origin/main HEAD is false for any branch that has not yet merged current main — which is the normal state of a row branch for most of its life, especially on this repo where origin/main moves several times an hour.
When it is false the gate does not run, and preflight prints no line at all for it. The run reports green. So "preflight all gates green" on a work-in-progress branch is not evidence that trailers are correct; it is evidence that nobody looked.
How it surfaced
On row/VT-FP8-W8A8-CPU-ARM (#468), seven commits carried
Assisted-by: AGENT:claude-opus-5[1m] [claude-code]
which check-commit-trailers.py rejects: [attribution] malformed Assisted-by value. The regex requires a space before the bracket group, so claude-opus-5[1m] is not a valid model token.
Every preflight run on that branch had reported all gates green. The defect only became visible after origin/main was merged in — at which point the ancestor test flipped true, the gate ran for the first time, and redded every commit. The repair then required rewriting all seven commit messages, which turned a plain push into a non-fast-forward one and needed a new branch to land without force-pushing.
The cost is not the malformed trailer. It is that the check was reported as passing when it had not executed — the same class as a test that reports Passed 0.00 sec with zero assertions, or a cases >= N floor set below the real count. An instrument that cannot say what it examined has not reported.
Corroboration: it has already leaked into main
At least two commits already on main carry the same malformed Assisted-by value. They could not have reached main if the gate had run on their branches.
What done looks like
- The trailer gate must run on every branch with commits, comparing against the merge base (
git merge-base origin/main HEAD) rather than requiring origin/main to be an ancestor. The merge base is well-defined whether or not main has been merged in, and origin/main..HEAD already resolves to it for the common case.
- When a gate is genuinely not applicable, preflight must say so by name and count it as skipped rather than printing nothing. A silent omission and a pass are indistinguishable in the output, which is what made this invisible.
- Audit the other conditional blocks in this script for the same shape —
doc-checkpoint range immediately above sits inside a similar guard.
- Repair the trailers already on
main, or record them as accepted debt with the reason, in whichever direction a reviewer prefers.
Found while landing #468.
Claim
scripts/agent-preflight.sh:222-225guards the trailer check:git merge-base --is-ancestor origin/main HEADis false for any branch that has not yet merged currentmain— which is the normal state of a row branch for most of its life, especially on this repo whereorigin/mainmoves several times an hour.When it is false the gate does not run, and preflight prints no line at all for it. The run reports green. So "preflight all gates green" on a work-in-progress branch is not evidence that trailers are correct; it is evidence that nobody looked.
How it surfaced
On
row/VT-FP8-W8A8-CPU-ARM(#468), seven commits carriedwhich
check-commit-trailers.pyrejects:[attribution] malformed Assisted-by value. The regex requires a space before the bracket group, soclaude-opus-5[1m]is not a valid model token.Every preflight run on that branch had reported all gates green. The defect only became visible after
origin/mainwas merged in — at which point the ancestor test flipped true, the gate ran for the first time, and redded every commit. The repair then required rewriting all seven commit messages, which turned a plain push into a non-fast-forward one and needed a new branch to land without force-pushing.The cost is not the malformed trailer. It is that the check was reported as passing when it had not executed — the same class as a test that reports
Passed 0.00 secwith zero assertions, or acases >= Nfloor set below the real count. An instrument that cannot say what it examined has not reported.Corroboration: it has already leaked into main
At least two commits already on
maincarry the same malformedAssisted-byvalue. They could not have reachedmainif the gate had run on their branches.What done looks like
git merge-base origin/main HEAD) rather than requiringorigin/mainto be an ancestor. The merge base is well-defined whether or not main has been merged in, andorigin/main..HEADalready resolves to it for the common case.doc-checkpoint rangeimmediately above sits inside a similar guard.main, or record them as accepted debt with the reason, in whichever direction a reviewer prefers.Found while landing #468.