fix(bin): reserve gate-refusal exit code so remote leg cannot report it as delivered - #2894
fix(bin): reserve gate-refusal exit code so remote leg cannot report it as delivered#2894harmeet-1337 wants to merge 1 commit into
Conversation
…it as delivered fm-send exit 3 meant two contradictory things: a no-mistakes gate-agent refusal (nothing was sent) and a delivered-with-unconfirmed-submit (do not resend). The remote send leg maps an inner exit 3 to delivered, so a gate refusal inside the remote host's fm-send would be reported as a delivered steer. Move the gate refusal to a reserved code (77) outside every lifecycle script's documented status space, document the reservation in fm-send's exit contract, and cover the remote gate-refusal path with a negative test that asserts a hard failure, a discarded expectation, and no closed decision. The gate-refuse suite now asserts against the sourced constant so the value stays owned in one place.
Confidence Score: 4/5The PR appears safe to merge, with a non-blocking architecture-documentation update needed to reflect the new refusal status. The production status relay and checked callers correctly treat exit 77 as a hard failure, and the regression test independently protects against collision with delivered-unconfirmed status 3; only the stale documented status remains. Files Needing Attention: bin/fm-gate-refuse-lib.sh and docs/architecture.md Reviews (1): Last reviewed commit: "fix(bin): reserve gate-refusal exit code..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| # must never collide with fm-send's delivered-unconfirmed exit 3, which the | ||
| # remote leg maps to "delivered, do not resend" - a gate refusal wearing exit 3 | ||
| # would be reported as a delivered steer. Keep this value out of that space. | ||
| FM_GATE_REFUSE_EXIT=77 |
There was a problem hiding this comment.
The refusal status is now 77, but docs/architecture.md still documents status 3 for this guard. That stale contract can lead maintainers or integrations to handle refusals as the delivered-unconfirmed status this change is designed to distinguish.
1 participant
Summary
Implements accepted simplification-audit finding F-S12-1 (P0).
fm-sendexit status3was overloaded to mean two contradictory things:The remote send leg maps an inner exit
3to delivered, so a gate refusal inside the remote host'sfm-sendwould be wrongly reported as a delivered steer.Change
bin/fm-gate-refuse-lib.sh- moveFM_GATE_REFUSE_EXITfrom3to a reserved77(outside every lifecycle script's documented status space) and update its header sentence explaining the reservation.bin/fm-send.sh- document code77in the header exit contract as reserved for the gate-agent refusal, never meaning delivered.tests/fm-gate-refuse.test.sh- assert against the sourced$FM_GATE_REFUSE_EXITso the value stays owned in one place; degeneralize stale "exit 3" wording.tests/fm-send-remote-delivery.test.sh- add a negative case where the ssh stub exits the reserved gate code with the gate stderr, asserting the parent fails loudly, discards the undelivered pending-reply expectation, and closes no--resolve-keydecision.Delivered-unconfirmed exit
3semantics are intentionally unchanged. Greppedbin/andtests/: no other caller branches on exit3fromfm-spawn/fm-send/fm-teardown/fm-controlas a refusal, matching the audit.Validation
bin/fm-lint.shclean (ShellCheck 0.11.0 + actionlint 1.7.12); both affected test suites pass; the remote gate-refusal case was regression-verified (fails when the constant is reverted to 3).