The gap I named and the Decoder prioritised: every --control run asserts that each
check fails on a perturbed contract, and none asserted that a broken control
reports broken. That is printing a verdict without asserting it, one level up. A
harness that silently approves a dead check is exactly as useless as a check that
silently approves a dead value.
contract-check --selftest feeds the machinery a stub that cannot fail -- a
function that prints 'everything is fine' and asserts nothing, which is precisely
the defect I shipped in verify-transcode-fidelity's unconditional return 0 -- and
requires the machinery to flag it. Exit codes follow the Decoder's convention: 0
all good, 1 a real check failed, 2 the HARNESS is broken and nothing it reported
can be trusted. Asserting in check-all.
It caught two defects while being written. The first version checked that the stub
left the failure counter at zero and then REASONED that control() would therefore
flag it -- arguing where a measurement was available, the error this whole thread
has been about, committed inside the tool built to prevent it. Rewritten to push
the stub through the real control() loop and read its verdict. It then returned 2
immediately: the stub was flagged, but as 'the control's own anchor is gone'
rather than as a dead check, because the src selection anchored anything not in
one specific list at the walk document instead of HANDOFF. A real failure for a
fabricated reason, which is the confusion ANCHOR SPLIT exists to separate.
Not covered and filed rather than left looking finished: check-claims, audit-kinds
and verify-transcode-fidelity have controls and no harness self-test. The shape is
known and the fix is cheap.
Every asserting check passes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N7FiFFFwbvG2uxdcEh8HyF
14c3bad7ad