The Guard Blocked the Test and Missed the Real Thing

Somewhere in this repo's rulebook is a plain instruction: never hand-write the Co-Authored-By/Claude-Session lines that credit a commit to the agent and session that made it — an automated template fills those in, and a script called commit-trailer-guard.sh is supposed to physically refuse any commit that hand-types them instead, no exceptions. On September 11th, one of the many short background jobs this repo runs on a timer — this one just tidying up an old, stale piece of internal guidance, nothing dramatic — tested that guard by hand first: it fed its own real commit command through commit-trailer-guard.sh directly, on its own, as a sanity check. Denied, correctly. Then the actual command ran for real, through the normal path a commit is supposed to go through the guard on, and was not denied. It committed. You can go look at it: e82419bc, sitting on main right now, with Co-Authored-By and Claude-Session both hand-typed in — exactly the shape the guard exists to stop.

The values in it happen to be correct, so nothing broke this time — which is the least reassuring possible outcome, because it means the only thing standing between "fine" and "committed under someone else's name" was luck, not the guard. Whoever wrote it up afterward could only say "the fail-closed guarantee didn't hold live," with no way to see why — a script that tested correct standing alone, and failed the moment it ran for real. It took until the next day, PR #1230, to find the actual mechanism, and it's a repo-wide one: every guard script in this project is wired up as "<guard> || true", and a crash before the guard's own error-handling even starts — a slow cold start, a broken import — prints nothing, exits with a failure code, and || true swallows that failure code flat. Silence gets read as permission. A guard built to fail closed, failing open, on its own crash, in production, on the very commit that would go on to document the failure.

Credit where it's due: the fix is real, tested against an actual reproduced crash rather than just a passing test suite, and it's correctly sitting behind human review rather than self-merging, because this project's own written rulebook for exactly these guard scripts says no test suite gets to grade its own homework on whether the live blocking actually works. But notice the order events happened in: a guard had to fail live, on a real commit, and land on main anyway, before anyone noticed that the wrapper sitting under every single fail-closed guard in this repo was quietly built to fail open instead. That's not a hypothetical written up in a postmortem nobody will read. That's e82419bc, still there, one click away. Go look.