Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / docs/POSITIVE_CONTROL_LIBRARY.md |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | 720d47fae476b0d38477ae4401697d372b1ea2bc |
| Branch | feature/opportunity-to-outcome |
| Path or archive member | docs/POSITIVE_CONTROL_LIBRARY.md |
| Original SHA-256 | 54ca5ec4b187daacb940d9ae79706458e8f5eeca6897f63e55c7c7e262331546 |
| Git blob SHA | 6821235904287a212a6e50431f3624b5c29022ff |
| Reading-copy SHA-256 | 54ca5ec4b187daacb940d9ae79706458e8f5eeca6897f63e55c7c7e262331546 |
Recovered source transcript
Download complete source text ↓56 lines · 6.3 KB
# THE POSITIVE CONTROL LIBRARY
Created 29 July 2026. Section 4 item 2 of docs/BUILD_CONTINUATION_PROTOCOL.md has said since
28 July that "every time an instrument is caught lying, the control that would have caught it
joins the permanent library and runs at every subsequent Gate D. The library only grows."
**It had no home, so it did not exist.** The rule was real and the artifact was not, which is
the same shape as every finding recorded below: a claim that was true about the intent and
false about the thing. This file is the artifact.
## How to use it
At every Gate D, run each control and confirm it FAILS as described. A control that passes is
not good news; it means the detector it guards has stopped detecting.
**The rule that generates this list:** an instrument that can pass while measuring nothing is
worse than no instrument, because it converts an unknown into a false certainty.
## The controls
| # | instrument | the lie it told | the control that catches it |
|---|---|---|---|
| 1 | frozen engine diff | diffed against a commit that ceased to exist after a history rewrite; `git diff` printed nothing and exit 0, which reads identically to no drift | assert the anchor commit EXISTS before trusting a clean result |
| 2 | frozen engine diff | diffed against a PATH that never existed, same silent zero | assert the path is non empty at BOTH ends before trusting a clean result |
| 3 | secret sweep | `git grep` searches TRACKED files only, so the planted control file was never scanned and the sweep passed on unrelated real findings elsewhere | plant the control in an UNTRACKED file and require it to be found |
| 4 | race profile | dropping FOR UPDATE still elected one winner because the timing did not interleave, so the control proved the harness ran rather than that the assertion can catch a second winner | remove the already claimed guard, making the defect DETERMINISTIC |
| 5 | pixel diff | the route interception missed the `?v=3` cache buster, so BOTH arms loaded the new stylesheet and the identical result proved nothing | render the OLD asset in one arm and require the measurement to differ |
| 6 | visual sweep | a sweep that renders nothing still reports zero findings | plant a 4000 pixel overflow and require it on every route at every viewport |
| 7 | fairness snapshot assertion | the assertion called the same enumeration function it was guarding, so if one returned nothing the other did too and it could never fire | assert against an INDEPENDENT companion reading the raw tables |
| 8 | concurrent extract memory profile | measured CUMULATIVE allocation, identical whether results are retained or discarded, and its control branch returned an error UNCONDITIONALLY so it reported success while detecting nothing | measure LIVE heap growth after a forced collection, and require the control to fail only because the measurement MOVED |
| 9 | concurrent extract memory cap | the cap was 4096 KB, a number chosen from nothing, and the real leak came in at 652 KB, under it | derive the cap from a measured counted run and a measured leak, so a defect must cross it |
| 10 | scrub flood | laundered payload CONTENT while keeping provenance and then blamed the gate for correctly allowing a payload whose only private element had been stripped; privacy has two sources and conflating them measures neither | plant a genuinely ALLOWABLE payload into the private set and require the misroute counter to fire |
| 11 | scrub flood | zero misroutes is also the score of a gate that refuses everything | count false refusals of legitimate public payloads in the same run |
| 12 | authenticated HTTP load | hammered flat out, saturated the rate limiter, and computed percentiles almost entirely from 429 responses while reporting PASS | assert a minimum SERVED share, so a run measuring only refusals cannot count |
| 13 | uptime watch | `curl ... \|\| echo 000` emitted BOTH a real code and the fallback, so a healthy 200 became "200000" and raised a false outage whose text hid the cause | accept exactly three digits or report 000, and control the checker against a hostname that cannot serve the app |
| 14 | any instrument, D16 | calibrated only at convenience scale: the soak was validated at 60 seconds and the protocol asks for 30 minutes, so its reporting step was never reachable | run once at the LARGEST input the protocol can demand, and record that run |
| 15 | pure unit tests, F3 | covered an allowlist, a size cap, a vocabulary and path traversal without ever touching Postgres, so a timestamptz scanned into a Go string meant the upload path had NEVER written a row | every database path gets at least one test that touches a real database |
| 16 | table reader | mojibake contains tabs, so a structural reader that bypasses the prose gate happily produced "tables" of character soup | require a readable word, a run of four letters containing a vowel, somewhere in the block |
| 17 | worker resource limits, D18 | an RLIMIT_AS of 1 GiB killed every Go child at startup, so every PDF silently fell back to the weaker reader and the run reported ok=1; a fix for one file degraded all of them | rerun a recorded known good fixture after ANY limit change and require its written numbers to match, 55 chunks not 3 |
| 18 | flag wiring, D17 | an edit deleted flag.Parse, so every flag stayed at its zero value and the deployed binary could not start | assert every binary declaring flags calls flag.Parse, tree wide |
| 19 | secret handling | flag usage output prints DEFAULTS, so any unknown flag disclosed a live credential from thirteen binaries | plant a secret in every relevant environment variable and require zero binaries to echo it on a usage error |
## Two habits this list is really about
**Every check that can pass by doing nothing gets a control.** The list above is what happens
when that rule is applied honestly to a build's own instruments rather than only to its code.
**A change that degrades rather than fails needs a number to compare against.** D18 produced no
red output, no failing test, and a worse product. The only thing that caught it was a chunk count
written down before the change. Record the number first.
**A wrong attribution closes a question that should have stayed open.** D16's first loss was
blamed on the D14 credential rotation landing at the same moment. The rotation was innocent,
and believing otherwise cost a second lost run. When two things change together, prove which
one did it.