Categories:

Attempt 8

Back to durable goal · Attempt history

Trigger

The fresh hosted review of the delivered standard-Cordis candidate found three valid starter-package defects: the JavaScript search fallback recursively read ignored and hidden files when ripgrep was absent, fallback submatch offsets used UTF-16 code units instead of ripgrep-compatible UTF-8 bytes, and a bounded textual HTTP body could end with a replacement character when the byte limit split a multibyte sequence.

Corrections

  • The JavaScript fallback now fails closed for directory searches and supports only explicitly selected files. This preserves hermetic single-file fallback without silently weakening ripgrep’s hidden and ignore filtering.
  • Fixed-string and regular-expression fallback matches calculate start and end from UTF-8 byte lengths.
  • Textual HTTP previews discard only an incomplete trailing UTF-8 sequence; the raw retained-byte count and truncation signal remain exact.
  • Follow-up review found that case-insensitive fixed matching could still use a length-changing lowercased index, explicit files did not override globs as they do in ripgrep, and unfiltered listing reparsed a malformed scope instead of returning the healthy scope with an error.
  • Case-insensitive fixed fallback now matches against the original line with a Unicode regular expression, explicit files bypass fallback glob filtering, and unfiltered listing returns per-scope errors alongside healthy packages. Explicitly listing a malformed scope continues to fail directly.
  • Final hosted review showed that a valid config with an unavailable module still bypassed the malformed-config catch, and bounded reads reported the requested range end instead of the last retained line. Unfiltered listing now skips every scope whose Include failed to mount, and bounded reads derive endLine from retained content.
  • Fresh diff-focused correctness scrutiny then found that repeated initialize() calls lost the original partial-startup errors. The runtime now preserves and clones those errors across idempotent initialization.
  • The same scrutiny found that incomplete UTF-8 suffix removal also ran for a naturally completed malformed textual body. It now runs only when the local byte cap truncates the response; naturally malformed bytes retain the prior replacement-character preview.
  • The repository’s repo-delivery skill now invalidates prior correctness verdicts after behavior-changing edits and requires proportional adversarial scrutiny in addition to test reruns.
  • Exact-thread reconciliation after the final hosted review exposed one older unresolved finding and one new finding: the explicit-file regex fallback matched UTF-16 surrogate halves, and cordis_define plus cordis_promote advertised overwriting operations as non-destructive. Regex fallback now uses Unicode scalar mode, and both source-overwriting tools carry the destructive MCP hint.
  • The next exact-commit review found two more fallback-boundary defects: adjacent matches were also emitted as context, and a retained empty line was reported like a request past EOF. Fallback search now plans a single ordered event stream from all matching lines, and bounded reads track range existence independently from textual content.

Evidence

  • Focused invocation b73ce3b4-bfb6-4081-b84f-29c3f763b3a4 passes both corrected starter-package test targets.
  • Complete MCP test invocation 93845f08-cd10-4dfb-88c5-034497dea58a passes all 7 tests; build invocation d7716a48-9509-44fe-9e37-b5c44904fffd builds all 16 targets.
  • Buildifier invocation 1fb561cc-d336-49db-813f-de26b7fedbe4 passes.
  • Regression cases prove directory fallback fails closed while an explicitly selected hidden file remains available, both fallback engines report byte offsets for éneedle, and a one-byte preview of é returns an empty valid UTF-8 prefix rather than U+FFFD.
  • Follow-up focused invocation c07704be-cdf8-4045-a0c0-4626ebc0d1e7 passes both affected targets. Complete test invocation 3fbaa4e1-8ea1-4b3f-a533-51e1ad01f87b passes all 7 tests, build invocation f87e45b6-765e-49c8-a618-cd2eb1efa1ad builds all 16 targets, and Buildifier invocation 8542838d-92ae-4999-b1e8-fac631629f6f passes.
  • Final-cycle focused invocation 99866999-c31d-457f-b64b-c7a15073e7a2 passes both affected MCP tests. Combined affected invocation e86a5d1c-cadf-4ff6-9647-3e1050e461e6 passes all 8 MCP and skill tests; 083fbf55-851e-4db4-b8e5-e5871c874faa builds all 19 affected targets. Skill quick validation and Buildifier both pass.
  • Focused starter invocation e80439df-bddd-4a76-b9e1-be6c7f1ed649 distinguishes a cap-split multibyte prefix from a naturally completed malformed textual body.
  • Exact aggregate validation exposed timing-sensitive evidence: a wall-clock admission bound failed under load, and the expected invocation timeout could reject before its assertion was attached. The test now asserts the wrapped synchronous-admission semantics and attaches the expected rejection before waiting for its PID fixture. Invocation e7d69598-b843-4da4-833b-e024d406b8ca passes three consecutive runs.
  • A later loaded aggregate run exposed a real HMR rollback race. Cordis restores the prior module cache after a failed import without emitting a reload event; the host unnecessarily waited for a second filesystem reload that could be absent. Rollback now accepts the already-restored prior source marker and waits for HMR only when the failed candidate actually reached the cache. Invocation 5f9b49e0-d3d3-4f9e-84ec-602dfbe38c77 passes three runs.
  • Focused invocation 132e2f33-837c-40b2-83b5-4b06ceadfd0f passes the Unicode fallback and real-stdio MCP annotation regressions.
  • Complete affected invocation b19d303e-0aca-4097-a191-e81015dc2982 passes all 8 MCP and skill tests; build invocation 1c8aa274-dd72-4e6f-9491-de5e283b2c5c builds all 19 targets, and Buildifier invocation 34f6f5c7-7f44-478b-b939-63ac03c3bbb1 passes.
  • Focused invocation 2528b6ee-7d82-48c9-a607-298a4cef0b9b proves adjacent matches remain ordered match events and empty retained lines report their actual endpoint while a request past EOF reports null.

Verdict

Accept locally. Publish the exact follow-up correction commit, resolve the hosted review threads, and verify the remote head before final handoff.