Gladex Agent Logs

> build · mimo-v2.6-flash-free
$ cd /data/repo && REGISTRY_COVERAGE_CHILD=1 bash tests/test_registry_coverage.sh 2>&1 | grep -E "VIOLATION|ERROR" | head -20; echo "---rc=$?"
VIOLATION help_convention promote-dev-to-prod
VIOLATION synopsis_flags promote-dev-to-prod
---rc=0
> build · mimo-v2.6-flash-free
$ cd /data/repo && sed -n '5240,5360p' tools/REGISTRY.md
skipped, none twice.

Since `[0.4.120]` it also checks that the **scope those probes read** is not an
artifact of their own convention (queue item (75)). G14 recounts with a
different reader but the *same* one-space rule, so the two agree **by
construction**: an option line written `--env  ENV` (two spaces) drops out of
the probing scope *and* out of the recount, `miss + fmt + port` still closes,
and the flag is never probed while every assertion stays green — a gap no red
anywhere could show. The third reader is independent of the spacing: a
metavar-shaped token (an upper run, `{enum}` or `a|b`) after any run of
whitespace, ending the line or followed by the 2+ space description column —
which is what keeps a boolean's running prose (`--json  JSON output`) out.
Measured over all 19 tools with option lists, its pair set is **identical** to
the probing scope's (58 = 58, empty difference in both directions), and because
a one-space line is visible to both readers whatever its token looks like, a
pair only the third reader holds can only be a line the scope cannot see:
`conv_extra > 0` is reported per tool as `VIOLATION help_convention <tool>`,
with `ERROR convention_no_scope` if the reader ever matched nothing. The
one-sentence style rule this item also offered (option lists put exactly one
space between flag and token) is therefore **enforced rather than written**,
which is the stronger of the two answers.

Since `[0.4.121]` the `--timeout` scope reads **the table's own exit-2 bullet**
instead of any mention of the token anywhere in the block (queue item (71)). The
block reader missed `tls-check`, whose exit-2 bullet says `bad port/timeout/
warn-days/ca-file/domain syntax` — no flag token in that block at all — although
the tool answers **2** for `--timeout 0`; and the obvious widening, *any* bare
mention of the word, pulls in `smtp-relay-probe`, whose `4 - ... within the
timeout` is a *greeting* deadline and which answers **3**. Measured over all 20
tables before the edit: block-level **6**, bare-word-level **8**, exit-2-bullet
**7** — and all 7 answer 2. Two conditions, each excluding a different false
reading: the **bullet** is the promise the probe holds the tool to (exit 4's
runtime `timeout` can never be read as a validation promise), and the tool's own
`--help` must advertise the flag, so a green here can never come from argparse
refusing a name the tool never had. `healthcheck` and `smtp-relay-probe` stay
out by construction — their exit-2 bullets promise nothing about a bad value —
which is the over-reach guard rather than a coincidence: a reader widened past
the bullet pulls one in and **G5**'s equality reddens, while a reader that
regresses to the block-level token drops `tls-check` and falls under **G4**'s
floor of 7. The bullet is read with its wrapped continuation lines
(`immich-roundtrip`'s `--timeout <= 0` is on the bullet's second row) and stops
at the next bullet or field header.

Since `[0.4.122]` the third reader no longer **requires** the 2+ space
description column (queue item (76)). That column was what kept a boolean's
running prose out — and it was also the one shape the reader existed for:
`--env  ENV Environment`, two spaces before the metavar (so the single-space
probing scope cannot see the line either) and the description on the very next
space (so this reader could not see it either). Both readers lose it at once,
`miss_n`, `scope_total` and `conv_pairs` all fall together, and
`miss + fmt + port == scope_total` still closes: **every assertion in the file
stays green over a flag nobody probes.** Measured over all 20 tools before the
edit — every `--help` line classified by shape — the four rows are **58** (one
space before the token, description indented: both readers), **0** (two spaces
before, description indented: the (75) class, third reader only), **1** (one
space before *and* after: `regression-run`'s own help body, scope only) and
**0** (two spaces before, description next: *neither* reader). Widening the
requirement to *one* space costs that single line of prose — whose pair
`regression-run`'s option line already holds — so `conv_pairs` stays **58** and
`conv_extra` stays **0** on the live tree, and no boolean prose is swept in
because none exists. What the reader reports is therefore the **writing**, not
the semantics: it cannot tell a metavar from an ALL-CAPS first word of a
boolean's description, so a boolean written `--json  JSON output` would now be
reported as `help_convention` — true of that line (it deviates from the
one-space convention C25 holds every tool to) and declared here rather than
left to be discovered. Control **C27** plants the shape.

Since `[0.4.123]` a reader finally looks at the row everything else skips:
the tool's **own synopsis** (queue item (77)). Every class above starts at the
option list or the exit-code table; none of them read `usage:`, so a tool
printing `Usage: … [OPTIONS]` — or printing `Usage:` alone with its flags on
the *next* row — was "covered" while its own words said nothing about what it
takes. The scope is a tool whose `--help` carries an option section (19 of the
20 registered tools; `pdns-api.py` lists subcommands and is excluded by that
line, not by a hand list), and the promise is one row long: the row carrying
the `usage:` label must name a flag. Measured over all 20 **before** any edit:
**16 held, 3 did not** — `verify-landing` (`[OPTIONS]`), `ip-drift-cron` and
`go-compile-drift-verify` (label alone, synopsis wrapped below). All three now
print the flags `REGISTRY.md` already documented for them, reported per tool as
`VIOLATION synopsis_flags <tool>` with `ERROR synopsis_no_scope` if the scope
ever reads nothing, and asserted as **G20–G23** (floor 15, `syn_n == syn_ok`,
no violation on the live tree) with control **C28** planting the exact shape on
a tool that is otherwise perfect. What this rule deliberately does **not** do:
hold every tool's synopsis to *every* pair it takes — (77) also measured that
pair-level reading at **31 of 58** value-taking pairs (33 after its own three
repairs) and called it a different, larger step.

Since `[0.4.141]` that step is taken (queue item **(79)**): the same row must
now name **every** `--flag METAVAR` pair the option list advertises, in the
option list's own spelling — `--env dev|prod` in the synopsis beside `--env
ENV` in the options is two different promises, and the option list is the side
every probe in this file reads. Re-measured on the tree *before* the repair,
by the same reader that counts `conv_pairs`, so the pair set is the option
list's and not a second list: **36 of 61** pairs held, **25 short across 11
tools** (`regression-run` 2/8, `immich-roundtrip` 2/7, `tls-check` 2/5,
`inbox-status` 3/5, `ip-drift-check` 2/4, `dns-verify` 2/3,
`smtp-relay-probe` 2/3, `repo-lint` 3/4, `domain-availability-check` 1/2,
`verify-landing` 1/2, `go-compile-drift-verify` 1/3) — the same 11 tools and
the same per-tool counts as (77)'s 33 of 58, three pairs having been added
elsewhere since. The **row** and not the whole wrapped block: argparse wraps a
*generated* usage at the terminal width, so `regression-run`'s synopsis is
four rows and its first row holds two of eight pairs — measured, not assumed —
and a continuation row is exactly what (77) already ruled out. The repair
writes the synopsis out: an explicit `usage=` is printed verbatim and never
wrapped (measured under `COLUMNS=80`) in the nine argparse tools, while the
two hand-written ones name the metavars their own option lists use (`--only
IDS` / `--format FMT`, `--env ENV`). That reintroduces a copy, which is the
objection `[0.4.59]`'s Q13 raised against one, and it is answered rather than
dismissed: an option added later whose pair never reaches the row reddens
**G33** instead of drifting quietly. Reported on the same
`VIOLATION synopsis_flags <tool>` line and the same subject — one tool, one
finding, so every control's "exactly one violation" still counts what it says —
asserted as **G31–G34** (keys present, floor 30, `synp_n == synp_ok`, never
more pairs than `conv_pairs` counted) with control **C30** planting the defect
on a tool (77) *passes*: `syn_ok == syn_n` while `synp_ok` sits one below
`synp_n` on the same plant, which is what proves the two rules are separate
claims rather than one rule counted twice.

Since `[0.4.140]` the probe finally reads the **metavar's own type** and asks the
value half of it (queue item (73)). (69) proved the shape — a port is an integer
1-65535 for every tool that has one, so `not-a-number` is invalid without asking
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/promote-dev-to-prod --help | head -8 | cat -A | sed 's/\$$//' | head -8; echo "=== option lines:"; ./tools/promote-dev-to-prod --help | grep -E "^  +--" | cat -A | sed -n '1,20p'
usage: promote-dev-to-prod [-h] [--dry-run] [--force] [--format {human,json}]
                           [--ledger-check | --ledger-seed]

Promote dev environment to prod (verdict gate, dev-sync gate, commit lint gate, ship-tree gate, build, restart)

options:
  -h, --help            show this help message and exit
  --dry-run             Evaluate the gates and show what would be done without
=== option lines:
  --dry-run             Evaluate the gates and show what would be done without$
  --force               Bypass the reviewer verdict gate, the dev-sync gate,$
  --format {human,json}$
  --ledger-check        READ-ONLY: exit 0 when every file in the four runtime$
  --ledger-seed         Append source=baseline records for the runtime files$
    --ledger-check   READ-ONLY standing assertion: every file in$
    --ledger-seed    append source=baseline records for the files not yet$
> build · mimo-v2.6-flash-free
← Edit repo/tools/promote-dev-to-prod
Index: repo/tools/promote-dev-to-prod
===================================================================
--- repo/tools/promote-dev-to-prod
+++ repo/tools/promote-dev-to-prod
@@ -1559,17 +1559,18 @@
     ledger = parser.add_mutually_exclusive_group()
     ledger.add_argument(
         "--ledger-check",
         action="store_true",
-        help="READ-ONLY: exit 0 when every file in the four runtime trees "
-             "carries a ledger record holding its current sha, 1 when one does "
-             "not (a direct edit bypassed this tool), 3 when the ledger or a "
-             "tree cannot be read. Never enters the promote flow."
+        help="read-only standing assertion: exit 0 when every file in the "
+             "four runtime trees carries a ledger record holding its current "
+             "sha, 1 when one does not (a direct edit bypassed this tool), "
+             "3 when the ledger or a tree cannot be read. Never enters the "
+             "promote flow."
     )
     ledger.add_argument(
         "--ledger-seed",
         action="store_true",
-        help="Append source=baseline records for the runtime files not yet "
+        help="append source=baseline records for the runtime files not yet "
              "attested (the first run, or to attest a deliberate direct "
              "edit). Writes nothing under --dry-run; never enters the promote "
              "flow."
     )

> build · mimo-v2.6-flash-free
← Edit repo/tools/promote-dev-to-prod
Index: repo/tools/promote-dev-to-prod
===================================================================
--- repo/tools/promote-dev-to-prod
+++ repo/tools/promote-dev-to-prod
@@ -1448,9 +1448,9 @@
   signal that survives is WHO recorded WHAT, and when. One JSONL record per
   file: {{ts, commit, env, path, sha, source}} with source = baseline | promote,
   kept at GLADEX_PROMOTE_LEDGER (default /data/agent-logs/promote-ledger.jsonl,
   outside the repo so appending never dirties the git tree).
-    --ledger-check   READ-ONLY standing assertion: every file in
+    --ledger-check   read-only standing assertion: every file in
                      dev+prod x {{src/php, examples/workflows}} must carry a
                      record holding its CURRENT sha. exit 0 when all are
                      attested, exit 1 when any file is not (naming env+path:
                      that is a direct edit that bypassed this tool), and

> build · mimo-v2.6-flash-free
$ cd /data/repo && REGISTRY_COVERAGE_CHILD=1 bash tests/test_registry_coverage.sh 2>&1 | grep -E "VIOLATION|ERROR|SUMMARY" | sed -n '1,3p' | cut -c1-400
SUMMARY tools=26 registered=42 test_sections=16 help_run=26 help_ok=26 badarg_run=26 badarg_ok=26 ec_run=26 ec_ok=26 fmt_n=22 fmt_value_ok=22 fmt_missing_ok=22 timeout_n=7 timeout_ok=7 port_n=4 port_value_ok=4 port_missing_ok=4 miss_n=44 miss_missing_ok=44 conv_pairs=69 conv_extra=0 fig_disc=99 fig_live=1 fig_claim=99 fig_stale=0 fig_undated=0 fig_head=99 fig_src=consistent syn_n=25 syn_ok=25 synp
> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Sat Oct 10 13:57:53 2026] 127.0.0.1:48584 Accepted
[Sat Oct 10 13:57:53 2026] 127.0.0.1:48584 Closing
[Sat Oct 10 13:57:53 2026] 127.0.0.1:48598 Accepted
[Sat Oct 10 13:57:53 2026] 127.0.0.1:48598 Closing
[Sat Oct 10 13:57:53 2026] 127.0.0.1:48610 Accepted
[Sat Oct 10 13:57:53 2026] 127.0.0.1:48610 Closing
[Sat Oct 10 13:59:38 2026] 127.0.0.1:43302 Accepted
[Sat Oct 10 13:59:38 2026] 127.0.0.1:43302 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42338 Accepted
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42338 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42350 Accepted
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42350 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42364 Accepted
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42364 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42372 Accepted
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42372 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42378 Accepted
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42378 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42386 Accepted
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42386 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42394 Accepted
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42394 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42406 Accepted
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42406 Closing
[Sat Oct 10 14:00:12 2026] 127.0.0.1:42416 Accepted
[Sat Oct 10 14:00:13 2026] 127.0.0.1:42416 Closing
[Sat Oct 10 14:00:13 2026] 127.0.0.1:42432 Accepted
[Sat Oct 10 14:00:13 2026] 127.0.0.1:42432 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38560 Accepted
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38560 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38576 Accepted
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38576 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38590 Accepted
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38590 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38592 Accepted
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38592 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38606 Accepted
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38606 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38614 Accepted
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38614 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38624 Accepted
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38624 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38634 Accepted
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38634 Closing
[Sat Oct 10 14:01:07 2026] 127.0.0.1:38650 Accepted
[Sat Oct 10 14:01:08 2026] 127.0.0.1:38650 Closing
[Sat Oct 10 14:01:08 2026] 127.0.0.1:38652 Accepted
[Sat Oct 10 14:01:08 2026] 127.0.0.1:38652 Closing
[Sat Oct 10 14:07:11 2026] 127.0.0.1:34564 Accepted
[Sat Oct 10 14:07:11 2026] 127.0.0.1:34564 Closing
[Sat Oct 10 14:07:11 2026] 127.0.0.1:34566 Accepted
[Sat Oct 10 14:07:11 2026] 127.0.0.1:34566 Closing
[Sat Oct 10 14:08:55 2026] 127.0.0.1:35456 Accepted
[Sat Oct 10 14:08:55 2026] 127.0.0.1:35456 Closed without sending a request; it was probably just an unused speculative preconnection
[Sat Oct 10 14:08:55 2026] 127.0.0.1:35456 Closing
[Sat Oct 10 14:08:57 2026] 127.0.0.1:35472 Accepted
[Sat Oct 10 14:08:57 2026] 127.0.0.1:35472 Closed without sending a request; it was probably just an unused speculative preconnection
[Sat Oct 10 14:08:57 2026] 127.0.0.1:35472 Closing
[Sat Oct 10 14:09:26 2026] 127.0.0.1:58130 Accepted