Findings from reviews that stand, with no verdict that stands. Reproduced ones first: execution backed them.
cfeb23e705c43a783bd1ed005bc35c5fdaf512335b6ecb6af9df111ca8b34450#R1 reproduced
VerifyInclusion treats the SET as optional (it is checked only when `len(entry.SET) > 0`), so deleting the SET from a stored Entry lets its IntegratedTime and global LogIndex be edited to anything and it still returns ok=true. The TUF key validity-window check, which lives only inside VerifySET, is skipped too. `corral certify verify` then prints the forged values as 'verified (publicly witnessed <time>, Rekor #N)'.
cfeb23e705c43a783bd1ed005bc35c5fdaf512335b6ecb6af9df111ca8b34450#R2 reproduced
The R2 signature binding fails open when the ENVELOPE, which is attacker input, fails to parse: an envelope carrying a signature that was never logged is refused on its own, but accepted (ok=true) once it also contains one non-string `sig` element, or when it carries no signatures at all. The reason string then falsely says 'unrecognized entry body shape'. Rekor never logs a zero-signature dsse envelope, so refusing these cases would break nothing legitimate.
cfeb23e705c43a783bd1ed005bc35c5fdaf512335b6ecb6af9df111ca8b34450#R3 reproduced
VerifyInclusion never compares the spec.envelopeHash that Rekor logged, so an envelope that differs from the logged one (here, a changed payloadType, which also makes its own signature invalid) passes as 'wraps the given envelope'. The given reason, that re-serialization would break the comparison, does not fit: Anchor submits the exact bytes and Rekor hashes those exact bytes (rekor dsse v0.0.1 entry.go:348/456).
659ec89015180093f0fbd8ca1668d1d8f482737751e0f473623eb21c9c99222f#R1 reproduced
In ParsePolicies, the semicolon truncation check is bypassed when the command fragment after ';' contains an '=' character, silently accepting the truncated weaker policy and discarding the remaining command into bad.
659ec89015180093f0fbd8ca1668d1d8f482737751e0f473623eb21c9c99222f#R2 reproduced
In ParsePolicies, strayFieldAfterCmd checks only for exact comma-delimited strings without whitespace tolerance, allowing trailing policy fields with spaces (e.g. ', base=release') to be absorbed into the command and silently converting the policy to gate all branches.
659ec89015180093f0fbd8ca1668d1d8f482737751e0f473623eb21c9c99222f#R3 reproduced
OpenStore fails to migrate existing gate_runs tables to include context in the primary key, causing multiple policy runs on the same commit head to overwrite each other via INSERT OR REPLACE and trigger an infinite execution loop on every poller tick.
659ec89015180093f0fbd8ca1668d1d8f482737751e0f473623eb21c9c99222f#R4 reproduced
Runner.Run passes an unpopulated Policy.Context ("") directly to StatusPoster.SetCommitStatus instead of defaulting to "corral/gate", causing commit status to post under the forge default context while the dedupe store records "corral/gate".
7f7b9576c7618ecda8af409c0fb981e88a0e851d9961e61f39b694b374befde3#R1 reproduced
Runner.Run posts "success" even when Store.Save fails (only logged at runner.go:107-109), contradicting its documented fail-closed invariant. No dedupe row is written, so every poll tick re-runs the jail, re-certifies (appending a new signed record each time) and re-posts success forever, and the status target_url /api/gate/run returns 404.
7f7b9576c7618ecda8af409c0fb981e88a0e851d9961e61f39b694b374befde3#R2 reproduced
ParsePolicies splits on ';' before it isolates cmd=, so a shell command such as "go vet ./... ; go test ./..." (run via sh -c) is truncated to the weaker "go vet ./..." and that policy is ACCEPTED. Only the orphaned tail is reported as bad. This is the 'truncated cmd manufactures a green gate' path the file's own comment says it prevents.
7f7b9576c7618ecda8af409c0fb981e88a0e851d9961e61f39b694b374befde3#R3 reproduced
Dedupe is keyed on (repo, head_sha) only. With two policies for the same repo and different contexts (e.g. corral/lint and corral/test), the first policy's run stores the row, and the Poller skips the second policy for every head, so its check never runs and its status context is never posted; if that context is a required check, the PR is blocked indefinitely.
7f7b9576c7618ecda8af409c0fb981e88a0e851d9961e61f39b694b374befde3#R4 reproduced
The dedupe row is saved BEFORE the final commit status is posted, both in Run and in FailClosed. If that post fails (forge 5xx, rate limit), Run returns the error, the Poller logs it, and every later tick skips the SHA as already gated. The verdict is never delivered to the forge, and the check stays pending or missing until someone pushes a new head.
7f7b9576c7618ecda8af409c0fb981e88a0e851d9961e61f39b694b374befde3#R7 reproduced
A large timeout= is accepted by strconv.Atoi, and time.Duration(TimeoutS)*time.Second then silently overflows to a negative duration. The sandbox turns any deadline <=0 into its 60s default, which is the very failure DefaultGateTimeout's comment says permanently blocks merge; no error is reported.
7f7b9576c7618ecda8af409c0fb981e88a0e851d9961e61f39b694b374befde3#R8 reproduced
A field placed after cmd= is silently swallowed into the command rather than reported as bad, despite the doc's promise that cmd parsing 'fails loudly'. "repo=o/r,cmd=make test,base=release" is accepted with Base=nil, which gates ALL bases, and CheckCmd [make test,base=release], with nothing in bad.
e1ad3ffb51e47a22f4b851dcfc240274e5220a8002e8be561af417a04bee07d2#R1 reproduced
VerifyInclusion accepts an empty JSON proof object and passes its nil RootHash to Rekor's converter, which panics instead of rejecting the malformed entry.
1072abdbec8e27d9aaa50cec8eb48f64d7aac71b46340f1cd6b6ab7c58f0b2c7#R1 reproduced
Apply silently accepts overlapping SEARCH anchors instead of rejecting them, applying the mutant to the first occurrence because strings.Contains on the remaining string misses the overlap.
f17af69e04e25ba49f3b2db72def3b1899433bdc772ad7efc0dea88a5d68aec5#R1 reproduced
The `label` and `provenance` parameters are not sanitized for the sentinel string, allowing an attacker to prematurely close the fence if they control these inputs (e.g., via a malicious filename).
f9a996461134b8b0eb0ded6777120109f34ec6d2dca83b5378457f267da24299#R1 reproduced
The `label` and `provenance` arguments are not sanitized against the sentinel string, allowing an attacker who controls either parameter to break out of the fence structure by injecting fake sentinels.
096353ae9c5e1daf9e0edc73a41fc9ee010ac2456719caeed8919bd426ef342d#R1 reproduced
JailScorer.CompliantFailure builds its command from scoreWorkspace instead of authoredCmd, so under a test selection it runs the run's raw project command — which never collects the authored test — and returns that run's output (ignoring the pass/fail bool) as the explanation of why the authored test failed on unmutated code, which is then fed to the writer's repair prompt and parsed for deselect selectors by salvageByDeselect.
096353ae9c5e1daf9e0edc73a41fc9ee010ac2456719caeed8919bd426ef342d#R2 reproduced
For the languages with no lang.Preambler (javascript, typescript, ruby, php) PreambleFor returns the file's first 40 lines, so shardCode emits a <=40-line file WHOLE into every generator shard while still returning chunked=true — the shard prompt then asserts "The code below is NOT the whole file — only the functions you are attacking" over a prompt containing the other shards' bodies, and ShardIsChunked signs Verdict.PromptShape as "chunk".
e920c2249182c0e3618175fb0bc719eeea04348435012e16615dc3f07955e859#R1 reproduced
Rank() reports Signal "churn-x-size" while the churn factor is uniformly 1 whenever root is a subdirectory of a git work tree, because fileChurn compares repo-root-relative `git log --name-only` paths against cwd-relative candidate paths — so a disclosed ranking rule silently degrades to size-only and --top selects the wrong files.
e920c2249182c0e3618175fb0bc719eeea04348435012e16615dc3f07955e859#R2 reproduced
BuildLanguageProfile attributes an exclusion by enumerating four reasons, so a source file relabelled by WidenCandidacyByEvidence to uncovered / import-only / no-executable-code is counted in NO bucket at all — LanguageStat.Total(), documented as "every file this language accounts for", silently shrinks on exactly the scans that collect coverage evidence.
e920c2249182c0e3618175fb0bc719eeea04348435012e16615dc3f07955e859#R3 reproduced
EmitJobs, on the FileScopedTests path, digests c.TestPath with no emptiness guard, so an evidence-only candidate (TestPath == "" by construction in WidenCandidacyByEvidence) aborts the ENTIRE scan with an error naming "." instead of the candidate; the only thing preventing this today is gradesFileScoped in a different package.
1174024081d1de39e5374a837e5626ae3760abec0ad0d1f606a85ec7f28e8768#R1 reproduced
append_summary bounds each report at 900,000 bytes against a limit that applies to the WHOLE step summary, so with a review configured the audit report plus one review report writes ~1.8MB — over the 1MiB cap the bound exists to respect — and neither call reports truncation, losing the entire summary including the audit verdict.
1174024081d1de39e5374a837e5626ae3760abec0ad0d1f606a85ec7f28e8768#R2 reproduced
The test-command description states the reserved-flag rule wrongly in both directions: it names --record as "the live collision" although --record is not a flag of `certify --repo` (the only certify the action runs) and so is never refused, while omitting --timeout and --json, which are, so the ordinary commands `go test ./... -timeout 30m` and `go test -json ./...` are rejected with exit 2 by a rule the operator was told does not cover them.
762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R1 reproduced
--max-proven-missed passes a scan containing a file whose every mutant was rejected by the compile gate: nothing was graded, ProvenMissed is 0 because nothing was asked, and the gate reads that as a pass — the fourth untrustworthy zero, next to the three the same function already fails closed on.
762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R2 reproduced
printWeakFile prints a literal "0.00" kill rate for a NO-GRADABLE-MUTANT file — the same fabricated zero it prints "withheld" for when the file is Uncovered, and the same zero signableKillRate refuses to put in the signed statement.
f30ac774c20373b9b286a8923f7abdc88fc1219a9e9745ecf53be21338acbc44#R1 reproduced
Deleting an entry's `signature` key does not change its hash, and the "unsigned entry in a signed chain" check is gated on `pub != nil`, so RequireIntactChain — and therefore LoadDir (the view, `verify --db`, the UI), AppendLedgerEntry and WriteCheckpoint — all report a chain with a stripped signature as intact, extend it, sign on top of it, and finally prune the evidence away.
f30ac774c20373b9b286a8923f7abdc88fc1219a9e9745ecf53be21338acbc44#R2 reproduced
PushLedgerDir gates a review entry's scripts and outputs on `e.Bundle.SourcePushed`, but a KindReview entry is built by WriteReview with a zero Bundle, so `corral ledger push --push-source` can never carry a reproduction's script or stdout to a warehouse and writes corral_reviews.source_pushed = false — the evidence for every REPRODUCED finding is silently dropped at the warehouse door while the view over the same directory carries it.
4401a6edc6066fbe0609f7df115b73663ee51f67c6a1614e24d5bf1a9acce890#R1 reproduced
`corral ledger push` performs no chain verification, so a ledger directory with an edited placed entry — one that `corral ledger append` and `corral ledger checkpoint` both refuse, and that `corral ledger verify` reports as broken — is pushed to the warehouse as the record, tampered bytes and all.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R1 reproduced
build-warehouse-parquet.py's operator-facing withheld count still feeds export()'s -1 refusal sentinel into `total - kept`, so a refused export prints "-1 rows exported, N+1 withheld" — a privacy-accounting line describing rows that were never withheld — even though the fix directly above it guards the manifest value against exactly that sentinel.
2a793fdf90c9742e91276ae5211ef7b8bcef5f60e632b1da2670a02cc6b55c2f#R1 reproduced
PushLedgerDir and LoadDir publish a ledger directory with no chain verification, so an entry whose bytes were edited after signing is loaded into the view and pushed into the operator's warehouse as the record — carrying its tampered numbers and its stale entry_hash — while AppendLedgerEntry and WriteCheckpoint refuse the very same directory.
2a793fdf90c9742e91276ae5211ef7b8bcef5f60e632b1da2670a02cc6b55c2f#R2 reproduced
A retraction never reaches the warehouse: rows pushed before the retraction are neither removed nor marked, and the schema has no retraction column at all, so `corral_seal` over the ledger directory and `corral_seal` in the warehouse pushed from that same directory give two different answers for the same file.
2a793fdf90c9742e91276ae5211ef7b8bcef5f60e632b1da2670a02cc6b55c2f#R3 reproduced
VerifyLedgerDir sets no Problem for an UNSIGNED entry even when a verifying key is supplied and every other entry in the chain is signed, so WriteCheckpoint — the one verb that deletes evidence, and whose guard exists precisely to stop laundering — prunes the signed history and enshrines the unsigned entry as the checkpoint's Head, after which the whole record verifies clean.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R1 reproduced
build-warehouse-parquet.py exports scans.parquet and scan_files.parquet with `SELECT * FROM scanstore.<table>` and no PUBLIC_REPOS predicate, so every repo corral has scanned on that machine — including private ones — is published to the static site, directly contradicting the module's own stated invariant that 'a repo is exported only if it appears in PUBLIC_REPOS'.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R2 reproduced
export()'s refusal sentinel -1 is fed straight into `total - kept`, so when a populated extract is protected from an empty source the tool prints '-1 rows exported' and publishes a `withheld` count one HIGHER than the source table's entire row count.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R3 reproduced
check-licensing.sh accepts a .go file that contains the SPDX string anywhere — including inside a string literal — rather than as a header, and add-spdx.sh has the same blindness, so an unlicensed Go file passes the CI licensing gate AND is refused by the fixer meant to repair it.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R4 reproduced
scrub-golden-run.py exempts any absolute path that merely BEGINS with '/work', '/tmp' or '/root' via str.startswith, so host-identifying paths such as /workspaces/<username>/... (the GitHub Codespaces layout) pass the deny gate the docstring says treats an escaped host path as a deny, not a manifest entry.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R5 reproduced
capture-recording-video.sh's slug argument names only the output mp4 and never selects the recording; its default output name (pool-fence-crossvendor) disagrees with the hero slug the built site actually renders (corral-audits-corral), so a default run overwrites site/public/recordings/pool-fence-crossvendor.mp4 with footage of a different run.
b5c32ad68564e1cc8417cb26c79a260eee61df53749562e0a61e149e11d0c4f1#R1 reproduced
The manifest's `code_path` is relative to eval/corpus while its `test_cmd` is rooted at the repo, so the mutant is written to a file the check command never compiles — every in-corpus target scores a mutant that cannot affect the suite.
b5c32ad68564e1cc8417cb26c79a260eee61df53749562e0a61e149e11d0c4f1#R2 reproduced
The `fence-neutralization` target's code_path `../../internal/fence/fence.go` escapes the workspace and is refused by the scoring workspace writer, so the corpus's first target can never be materialised or graded.
b5c32ad68564e1cc8417cb26c79a260eee61df53749562e0a61e149e11d0c4f1#R3 reproduced
Go's passwd.Valid measures BYTES (`len(p)`), not characters, so it accepts an 11-character password and contradicts the goal string the manifest signs the run with.
b5c32ad68564e1cc8417cb26c79a260eee61df53749562e0a61e149e11d0c4f1#R5 reproduced
The five 'same validator' fixtures do not implement the same rule: Go treats a space as not-a-symbol (unicode.IsPunct/IsSymbol) while Python/Ruby/JS/TS count any non-alphanumeric, so the same input gets opposite verdicts across the corpus the README says is one validator in five languages.
cd8d5d2dffaddb9c4e42e2ac5e51542bc8c63a9af3191adce8a9f928e77c187f#R1 reproduced
`Retracted` is not a fixpoint: at every odd retraction depth >= 3 (retract A, retract that retraction, retract that one) it reports A as NOT retracted, so a retracted scan is served live to the DuckDB view, the warehouse push, the verdict cache, the prior and `corral scans`.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R1 reproduced
deploy.yml gates the generated-documentation drift checks (cost-model table, before/after page) on `steps.filter.outputs.code == 'true'`, so a Markdown-only pull request — the only change class that can hand-edit those generated .md pages — is exactly the pull request on which the checks never run, and hand-edited drift ships.
09b6b339405f83a44741b2fc83df2829d3614ad3da602d198f0960909de7b3ac#R1 reproduced
docs/ui-tour/memory.mdx tells the reader the brain's memory corpus is something "every `corral certify --local` run can draw on", eight lines below its own banner stating that no audit ever reads shared memory — and `certify --local` runs in-process with no brain, so the claim is false in the direction that flatters the product.
09b6b339405f83a44741b2fc83df2829d3614ad3da602d198f0960909de7b3ac#R3 reproduced
docs/ui-tour/skills.mdx documents `corral sync` as the command that reads/writes the artifact store and carries an approved skill to every fleet member, but cmd/corral/main.go dispatches no `sync` verb and no binary's generated CLI reference names one, so the instruction cannot be followed.
09b6b339405f83a44741b2fc83df2829d3614ad3da602d198f0960909de7b3ac#R4 reproduced
github-action.mdx promises that "a diff that touches no auditable candidate is a legitimate pass... exits 0", but repoScanExitCode returns 1 whenever the diff's changed source files could not be paired with a test — the repo's own TestUnpairableDiffFailsTheGate pins that — so on the JS/TS layouts the code comment calls the common path the gate goes red for a reason the docs call a pass.
09b6b339405f83a44741b2fc83df2829d3614ad3da602d198f0960909de7b3ac#R5 reproduced
github-action.mdx tells the reader to "leave `diff-base` at its default" because "passing it empty audits the whole repository, which is a deliberate opt-in, not a default" — but action.yml's default for diff-base IS the empty string, and the action only derives a base from GITHUB_BASE_REF, so on the `workflow_dispatch` opt-in the same page recommends the default silently audits the entire repository.
09b6b339405f83a44741b2fc83df2829d3614ad3da602d198f0960909de7b3ac#R6 reproduced
concepts/trust-and-security.mdx says the isHumanAdmin rule "guards **thirteen** admin write paths" and then enumerates fourteen of them; the code has 36 such guard sites, and the list omits gates the docs elsewhere present as the human gate (adjudicate_critic_finding, promote_control, the mission-steering writes), so a reader auditing the trust model gets a wrong and incomplete inventory.
09b6b339405f83a44741b2fc83df2829d3614ad3da602d198f0960909de7b3ac#R7 reproduced
docs/ui-tour/records.mdx describes "the **four checks** certverify.VerifyRecord runs (signature, ledger, subject, rekor)" but VerifyRecord runs five, and the one omitted is "statement" — the check added precisely because a record's human-readable half could be doctored while verify still printed "verified"; unlike the signed console bundle the code comment excuses, this file is freely editable.
09b6b339405f83a44741b2fc83df2829d3614ad3da602d198f0960909de7b3ac#R8 reproduced
limitations.mdx — the page linked from every other page as the honest current state — describes the product as "v0.8.x" and names "v0.1" operational ceilings, while the repository at this commit tags v1.0.0-rc.11 and getting-started tells the reader to install that exact pin.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R1 reproduced
WriteCheckpoint prunes a ledger directory without ever verifying the chain, so `corral ledger checkpoint` silently deletes a tampered entry and leaves a genesis that verifies with no problem — the one verb that destroys evidence is the one verb that never looks at it.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R2 reproduced
An entry's keyid is deleted before hashing and is never checked against the signature, so rewriting `keyid` in a placed, signed entry leaves HashOK, SigOK and Problem untouched while `corral verify --ledger` prints the attacker-chosen key name as the signer.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R3 reproduced
CanonicalizeForWarehouse mutates the caller's row slices in place — the exact thing its partner BlankUnpushedSource copies to avoid — so the statement hasher (prepareRowsForHash, which calls it before copying) silently truncates the caller's event timestamps and nils the caller's kill rates on a --push-source bundle.
28c4ae555cbc0e686bc6a9ff86a267453c9619e306f250a9c5d36bc6db42f8ce#R3 reproduced
WidenCandidacyByEvidence reads lang.FileCoverage.HasStatements' ZERO VALUE (false) as a positive "coverage's static parse found no executable code" finding, so any selector whose Index does not explicitly set the field relabels every genuinely-uncovered file as the benign ReasonNoExecutableCode instead of ReasonUncovered — absence of evidence read as evidence of absence, in the direction that silences the loudest finding the audit produces.
cfeb23e705c43a783bd1ed005bc35c5fdaf512335b6ecb6af9df111ca8b34450#R4 no-script
R2 is still open for intoto v0.0.2 entries. sigstore-go's GetDssePayloadHash returns a payload hash for intoto (tlog/entry.go:452), so step 3 passes. loggedSignaturesCover then reads only spec.signatures, finds nothing, and returns checked=false, so step 4 is skipped. Yet an intoto body does record its signatures, at spec.content.envelope.signatures. So an envelope with a never-logged signature verifies against any intoto entry anyone logged over the same payload, and the stated rationale ('cannot tell a bad case from a legitimate one') is false for this kind.
cfeb23e705c43a783bd1ed005bc35c5fdaf512335b6ecb6af9df111ca8b34450#R5 no-script
The 'never silently so' promise (rekor.go:225-227) is not kept at the `corral certify verify` door. Details are printed only for FAILING checks; on success the CLI prints its own 'verified (publicly witnessed …)' line, so the suffixes '(no SET present)' and 'signatures not compared' never reach the user.
cfeb23e705c43a783bd1ed005bc35c5fdaf512335b6ecb6af9df111ca8b34450#R6 no-script
doc.go says a later `corral certify verify` re-checks the inclusion proof 'without touching the network again'. But each verify builds a fresh witness via NewRekorWitness, which calls root.FetchTrustedRoot(). With sigstore-go's default CacheValidity of 0 that is an online TUF refresh, so verification needs the network.
cfeb23e705c43a783bd1ed005bc35c5fdaf512335b6ecb6af9df111ca8b34450#R7 no-script
Anchor's comment says it re-fetches by UUID 'until' the inclusion proof is present, but it makes a single attempt. On a UUID miss, fetchEntryByUUID takes an arbitrary map element without checking it is the entry just created.
cfeb23e705c43a783bd1ed005bc35c5fdaf512335b6ecb6af9df111ca8b34450#R8 no-script
Logger.Get never checks that the fetched entry is a dsse entry, or that its LogIndex is the one requested. A non-dsse entry yields EnvelopeSHA256 == "" with no error, so `corral verify` reports a tamper-style hash mismatch (exit 1) when the real problem is an index pointing at the wrong kind of entry.
659ec89015180093f0fbd8ca1668d1d8f482737751e0f473623eb21c9c99222f#R5 not-shown
Runner.Run calculates the jail timeout as time.Duration(p.TimeoutS) * time.Second without bounds checking, allowing large TimeoutS values to overflow int64 into negative durations that cause the sandbox to fall back to its 60-second default.
7f7b9576c7618ecda8af409c0fb981e88a0e851d9961e61f39b694b374befde3#R5 no-script
Scenario: the brain shuts down mid-run and cancels ctx. RunGuarded returns a 'cancelled' error, Run takes fail(), FailClosed stores Passed=false permanently (Save does not use ctx), and then the status post with the cancelled ctx fails. The forge keeps the earlier "pending" indefinitely, and after restart the poller skips the head as already gated. Any transient checkout failure is likewise made permanent.
7f7b9576c7618ecda8af409c0fb981e88a0e851d9961e61f39b694b374befde3#R6 no-script
Runner.Run does not check that p.CheckCmd is non-empty; only ParsePolicies enforces it. A Policy built programmatically, for example via brain Options.GatePolicies, with no CheckCmd sends "" to the jail. The jail runs sh -c on rlimitPrelude+"", which exits 0, and "success" is posted for a check that ran nothing.
e1ad3ffb51e47a22f4b851dcfc240274e5220a8002e8be561af417a04bee07d2#R2 no-script
VerifyInclusion compares only the payload hash, so a replacement envelope signed by a different key over the same payload can reuse the original envelope's inclusion proof without that replacement signature ever having been logged.
132490d49d328e6a8b5ebc0399bad312e39ee9459613cb519066e7cf80533877#R1 not-shown
ScrubbedEnviron does not drop CORRAL_TOKEN (the agent's bearer token set by the launcher), so the workspace substrate leaks it to untrusted test commands via cmd.Env = sandbox.ScrubbedEnviron().
132490d49d328e6a8b5ebc0399bad312e39ee9459613cb519066e7cf80533877#R2 not-shown
CappedWriter.String() can exceed its Max by 22 bytes (the truncation marker + newline) when the buffer is full, violating the size bound that TailWriter explicitly maintains. A caller trusting MaxOutput as a hard ceiling on Result.Output gets a longer string than expected.
132490d49d328e6a8b5ebc0399bad312e39ee9459613cb519066e7cf80533877#R3 not-shown
Resolve's error message for an unknown backend says '(want bwrap|container|none)' but omits the two other valid backends: 'sandbox-exec' and 'windows-job'. An operator who misspells one of them gets an error that does not mention the correct name.
132490d49d328e6a8b5ebc0399bad312e39ee9459613cb519066e7cf80533877#R4 no-script
On Windows, proc_windows.go assigns the process to the job object AFTER cmd.Start(), creating a race window where the process (and any children spawned during that window) run outside the job object. A child spawned before AssignProcessToJobObject completes would survive a cancel/timeout kill.
132490d49d328e6a8b5ebc0399bad312e39ee9459613cb519066e7cf80533877#R5 no-script
The darwin sandbox-exec backend does not apply the PerEntry filter to ReadOnlyBinds: it grants (allow file-read*) to the entire Host directory, so dot-entries (.vite, .cache) that perEntryBinds() explicitly skips on bwrap/container are readable on macOS. While this does not cause EROFS (no bind mounts), it is a parity gap between backends.
f9a996461134b8b0eb0ded6777120109f34ec6d2dca83b5378457f267da24299#R2 no-script
Because `label` and `provenance` are interpolated into the preamble before the second sentinel (the boundary of the designated 'DATA' block), an attacker controlling them can inject instructions into the preamble that the LLM may consider outside the restricted fences, even without forging a sentinel.
096353ae9c5e1daf9e0edc73a41fc9ee010ac2456719caeed8919bd426ef342d#R3 no-script
matrixAdjudication auto-CONFIRMS a test-critic's "this test can never fail" finding whenever the test killed none of the run's mutants and any other test killed one, which confirms a vacuity claim for a perfectly good test that simply asserts behaviour the generator did not mutate — and that confirmation both persists to the signed-record-linked CriticFindings sink and earns the critic a leaderboard PASS.
096353ae9c5e1daf9e0edc73a41fc9ee010ac2456719caeed8919bd426ef342d#R4 no-script
Verdict.TestWriterFailed's doc asserts "aggregate forces needs-review whenever Survivors > 0 and ProvenMissed < Survivors — see aggregate", but aggregate implements no such rule (its only terms are blockingFindingOpen, devKillRate < threshold, testWriterFailed, poolTestUnsound and the Wilson-width check), so a reader relying on that comment believes an unproven-gap guard exists that does not.
096353ae9c5e1daf9e0edc73a41fc9ee010ac2456719caeed8919bd426ef342d#R5 no-script
aggregate never gates on BaselineFailed or SuiteIgnoresFile — the two could-not-grade states are carried onto the Verdict after aggregate returns, and the only thing keeping such a run out of StatusCertified is devKillRate(0) < threshold, which is enforced solely by NewDriver's threshold > 0 check; a Driver built as a struct literal (as this package's own tests do) with Threshold 0 signs StatusCertified over a run that graded nothing.
e920c2249182c0e3618175fb0bc719eeea04348435012e16615dc3f07955e859#R4 no-script
EvidenceIndex answers "which tests cover this file" two different ways from the same parse: coveringTests is len(fc.Tests) (every listed test id) while coveringFiles admits only ids with lines > 0, so an evidence document carrying a zero-line test id yields CoveringTests > 0 and a mostCovering hint while CoveredByAny — the oracle a --diff-base scan uses to decide which sources a changed test defends — reports false for every test file.
e920c2249182c0e3618175fb0bc719eeea04348435012e16615dc3f07955e859#R5 no-script
Preflight has no guard against an instrumented run that exits non-zero and prints nothing — it uses the plain commandRunner (no exit code, no stderr) and hands empty stdout straight to ParseCoverage, unlike CollectSelectionEvidence which was hardened for exactly that case; only each plugin's own ParseCoverage happening to reject empty input keeps Preflight from returning Ran=true with an empty Executed map, i.e. a repo-wide "your suite touches nothing".
e920c2249182c0e3618175fb0bc719eeea04348435012e16615dc3f07955e859#R6 no-script
RepoReport documents "UncoveredFiles is a SUBSET of SelectedFiles", but Aggregate increments UncoveredFiles from r.Verdict.Uncovered without regard to whether TestSelection.Method was set, so a verdict carrying Uncovered on the whole-suite path would make UncoveredFiles exceed SelectedFiles and break the stated partition a printer relies on.
1174024081d1de39e5374a837e5626ae3760abec0ad0d1f606a85ec7f28e8768#R3 no-script
The step sets motherduck_token — a real credential variable name — unconditionally from a possibly-empty input, so a workflow that supplies the token at job/workflow level has it blanked by the step and an md: push fails for a missing token that was present; the same script goes to explicit lengths (lines 208-264) never to export an empty value for any model API key.
1174024081d1de39e5374a837e5626ae3760abec0ad0d1f606a85ec7f28e8768#R4 no-script
CORRAL_ATTEST_PATH is written to $GITHUB_ENV at line 290, before the test-command validation that can exit 1 at lines 331/343/389, so a run that never reaches corral still triggers the predicate step, which then warns "see the run step's own warning for why" — pointing the reader at a corral warning that was never emitted because corral never ran.
1174024081d1de39e5374a837e5626ae3760abec0ad0d1f606a85ec7f28e8768#R5 no-script
attest and push-source are compared with a literal string equality against "true", so any other truthy spelling an operator writes (yes, on, 1, TRUE) silently disables the receipt or the source push rather than being refused, contrary to the file's own stated standard elsewhere that a bad value is "refused rather than silently ignored".
762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R3 no-script
On the --diff-base path, evidence widening appends candidates to `selected` with no --top bound, so an explicit --top that the same branch deliberately honours 400 lines earlier can be exceeded — the exact second door the whole-repo branch re-ranks under the bound to close.
762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R4 no-script
unpairableInDiff is collected only for reposcan.ReasonNoPairedTest, so a changed source excluded as `ambiguous-test` (candidate.go:740) is neither audited nor reported: selected is empty, nothingInScope is true, skipEvidence suppresses the one pass that might rescue it, and the merge gate exits 0 on a pull request whose only changed source file was never looked at.
762d6ec6e5e9ed0115f76fafb739b34dcccfc8f6a947a7ac803db7883bd05f1d#R5 no-script
The --push rows are stamped with `entries[len(entries)-1].Hash` read from the ledger directory regardless of whether THIS scan's ledger write just failed, so a failed entry write (full disk, lock contention — a fail-open path by design) leaves every pushed warehouse row pointing at the PREVIOUS scan's entry hash.
f30ac774c20373b9b286a8923f7abdc88fc1219a9e9745ecf53be21338acbc44#R3 no-script
RequireIntactChain's doc claims "every door calls it", but the two readers that change what a LATER audit does — internal/prior's prior loader and cmd/corral's verdict cache — read the record through ReadLedgerDir with no chain verification, so a tampered or reordered ledger can still seed priors and serve cached verdicts.
f30ac774c20373b9b286a8923f7abdc88fc1219a9e9745ecf53be21338acbc44#R4 no-script
An adjudication's finding id is validated only inside WriteAdjudication; EntryShapeProblem checks only the `<hash>#<id>` shape and VerifyLedgerDir checks only that the named review exists, so an adjudication placed through AppendLedgerEntry (the `corral ledger append` door) naming a finding id that no review carries is signed and verifies clean, and Adjudications() returns it as a standing verdict on nothing.
f30ac774c20373b9b286a8923f7abdc88fc1219a9e9745ecf53be21338acbc44#R5 no-script
CanonicalFullJSON re-marshals through encoding/json, which replaces unpaired surrogates and invalid UTF-8 with U+FFFD, so distinct entry byte-strings canonicalize — and therefore hash and verify — identically, contradicting the surrounding claim that the entry's hash is over its bytes as written.
4401a6edc6066fbe0609f7df115b73663ee51f67c6a1614e24d5bf1a9acce890#R2 no-script
Retracting a scan the warehouse has ALREADY received is a silent no-op: PushLedgerDir tests `have[e.Hash]` (already pushed) before it tests liveness and never deletes or flags the existing row, so `corral ledger push` reports it under "already there, skipped" and prints no "retracted scan(s) left out" line — contradicting this file's own help, which says a retracted scan "stops being the record — the view … skip it".
4401a6edc6066fbe0609f7df115b73663ee51f67c6a1614e24d5bf1a9acce890#R3 no-script
--expect-head, declared here as "the hash this chain's newest entry must have" and described as the only anchor that can catch end-truncation, is compared with strings.HasPrefix and has no minimum length or format check, so `--expect-head a` passes on roughly one chain in sixteen and a truncated or mistyped anchor silently reports "nothing was removed from the end".
4401a6edc6066fbe0609f7df115b73663ee51f67c6a1614e24d5bf1a9acce890#R4 no-script
runLedger passes the ENTIRE argv to wantsHelp, which matches "-h", "--help" or "help" in any position, so `corral ledger retract <dir> <hash> --reason help` prints usage and exits 0 without writing a retraction — a destructive-intent command reporting success for work it did not do; runScans, runReview and runCriticScore all guard against exactly this (criticscore.go:153-157 names it as a hazard) by passing args[:1] or answering help first.
4401a6edc6066fbe0609f7df115b73663ee51f67c6a1614e24d5bf1a9acce890#R5 no-script
The "never re-linked in place" guard compares filepath.Abs paths, which clean but do not resolve symlinks, so `corral ledger append <dir>/scans-symlink/entry.json.gz <dir>` (or any symlinked route to a placed entry) escapes the check and re-links a placed entry into its own directory.
4401a6edc6066fbe0609f7df115b73663ee51f67c6a1614e24d5bf1a9acce890#R6 no-script
The retract success line reads "retracted <hash> in <name>" where `name` is the new entry's FILE NAME, not the directory the sentence implies, and it echoes the operator's unresolved prefix rather than the hash WriteRetraction actually resolved and recorded — so the confirmation does not show what was retracted.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R2 not-shown
check-licensing.sh derives its entire file list from `git ls-files`, whose failure is indistinguishable from an empty repository, so with git unavailable the SPDX-header invariant reports "OK: all licensing invariants hold" and exits 0 over a tracked .go file that carries no header at all.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R3 no-script
export-golden-run.sh writes the mission `directive` (free-form operator text) into the published .meta.json sidecar without it ever passing the deny-list scan or the human-review manifest, and it is fetched after the operator's confirmation prompt, so the "not optional, not an assumption" privacy gate covers only the replay stream and not half of what is published beside it.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R4 no-script
gen-cost-table.py's cost_line, declared a byte-for-byte replica of cmd/corral/cost_line.go's costLine and used to publish "the exact cost: lines corral scans show --timing prints", omits the Go version's " (N cached)" clause entirely, so any fixture whose model_calls carry a non-null cached_input_tokens generates a documented CLI line the CLI never prints.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R5 no-script
add-spdx.sh skips any file containing the string "SPDX-License-Identifier" anywhere, while check-licensing.sh only accepts it as a comment inside the first five lines, so a file carrying the identifier in a string literal or below line 5 is flagged forever by the checker and never fixed by the fixer — the fixer/checker disagreement its own comment says must not exist.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R6 no-script
check-security.sh gates only gofmt's PRESENCE, not its success: `bad=$(git ls-files '*.go' | xargs gofmt -l)` discards the exit status, so gofmt failing (an unparseable file, a path xargs split on whitespace, a missing file) produces empty output and the formatting gate reports clean.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R7 no-script
export-golden-run.sh interpolates $MISSION_ID and $MODELS_JSON unquoted into Python source passed to `python3 -c`, so a mission id or a model label originating from the brain's own JSON that is not a bare integer / contains a quote or backslash either breaks the export or executes as Python.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R8 no-script
sign-console-bundle.sh's header documents its output as a signature with "no trailing newline (matches the exact bytes GET /console/manifest.sig serves)", but cmd/sign-console-bundle's upsert returns `strings.Join(out, "\n") + "\n"`, so the committed file has always ended with a newline and the documented byte-equality claim is false.
6c87da8a5a04ecca1ba65c23ae81d6ac0fea7c2a1f8b19f8fd1467fe0a6a2fe9#R9 no-script
capture-og-image.sh's post-launch safeguard checks `kill -0 $BRAIN_PID` rather than that our child owns the listening socket, so if the scratch brain died on bind failure and has not yet been reaped, the liveness probe succeeds and the capture shoots whichever brain actually owns port 9019.
2a793fdf90c9742e91276ae5211ef7b8bcef5f60e632b1da2670a02cc6b55c2f#R4 no-script
EntryHash for a corral-ledger-2 entry throws away the file's own bytes (e.Raw) and re-marshals this binary's structs, so any key present in the file that the current LedgerEntry/Bundle structs do not model is silently dropped by json.Unmarshal before hashing and cannot break the entry's hash or its signature.
2a793fdf90c9742e91276ae5211ef7b8bcef5f60e632b1da2670a02cc6b55c2f#R5 no-script
IsLedgerDir treats ANY existing directory as a ledger directory, so a mistyped `--db /home/me` or `--db .` is not refused but silently converted into one — writeLedgerFile MkdirAll's a `scans/` subdirectory inside it and starts a new chain there — with no check that the path was ever a ledger directory.
2a793fdf90c9742e91276ae5211ef7b8bcef5f60e632b1da2670a02cc6b55c2f#R6 no-script
PushLedgerDir gates source custody for scan entries on what the entry actually carries (`withSource && e.Bundle.SourcePushed`, the R4 fix) but passes `withSource` straight through for review entries, so insertReviewEntry writes `corral_reviews.source_pushed = true` for a review whose findings carry no scripts or output at all — the same unearned custody claim R4 names, at the door R4 did not close.
2a793fdf90c9742e91276ae5211ef7b8bcef5f60e632b1da2670a02cc6b55c2f#R7 no-script
PushPlan.Retracted is incremented for retracted entries of every kind, but `corral ledger push` prints it as "N retracted scan(s) left out", so a retracted review or adjudication is reported to the operator as a retracted scan.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R6 no-script
export-golden-run.sh runs the deny scan and the human-review manifest only over the replay stream; the .meta.json sidecar's `directive` (free text fetched from the brain) is retrieved AFTER the operator's confirmation prompt, never deny-scanned and never shown in the manifest, yet it is written into site/src/data/recordings/*.meta.json and published.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R7 no-script
check-security.sh's gofmt invariant redirects stderr to /dev/null and treats empty stdout as clean, so if gofmt is absent, non-executable, or errors on a file, `bad` is empty and the formatting gate silently passes — the opposite of the gosec branch immediately below it, which fails closed when its tool is missing.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R8 no-script
gen-before-after.py's splice() calls text.index(start) with no guard, so a target file that has lost its before-after markers crashes with a ValueError traceback instead of the loud, named failure gen-cost-table.sh:39 gives for exactly the same condition — under --check the drift gate dies rather than reporting.
9759aee2e1ea1f4fb8439c91e6353a2f42779e4ba472bc92d2e054759b32da41#R9 no-script
export-golden-run.sh interpolates the operator-supplied $MISSION_ID directly into a python3 -c program (`x.get('id') == $MISSION_ID`), so a non-numeric --mission value is a syntax error or arbitrary Python rather than an argument-validation failure.
b5c32ad68564e1cc8417cb26c79a260eee61df53749562e0a61e149e11d0c4f1#R4 not-shown
The `passwd-thorough` target is labelled expected_adequacy=thorough with no known_gap, yet a live mutant weakening the length bound from 12 to 11 survives its entire suite — so a pool that correctly finds that survivor is reported as "inventing gaps (over-sensitive)".
b5c32ad68564e1cc8417cb26c79a260eee61df53749562e0a61e149e11d0c4f1#R6 no-script
eval/corpus/passwd_ts/passwd.test.ts imports "./passwd.ts" with an explicit .ts extension, which tsc rejects (TS5097) unless allowImportingTsExtensions is set, and the corpus ships no tsconfig.json — so the README's documented "tsc + node:test" TypeScript reproduction cannot compile as given.
b5c32ad68564e1cc8417cb26c79a260eee61df53749562e0a61e149e11d0c4f1#R7 no-script
The corpus calls itself versioned but its version is not a function of its content: the fence target's code_path points outside the corpus at live engine source, while the resume key is (corpus_version, target id, iteration) with no target digest, so re-runs after the engine changes are pooled into one report as if measured against the same corpus.
b5c32ad68564e1cc8417cb26c79a260eee61df53749562e0a61e149e11d0c4f1#R8 no-script
expected_survivors is only ever used as a floor (report.go:132 flags MeanSurvivors below it and nothing above it), and both gappy targets declare 1 while their suites in fact admit several independent survivors, so an arbitrarily over-sensitive pool on a gappy target is reported Calibrated.
cd8d5d2dffaddb9c4e42e2ac5e51542bc8c63a9af3191adce8a9f928e77c187f#R2 no-script
AppendLedgerEntry re-hashes only the HEAD entry, so a chain whose non-head entry was edited is extended and signed anyway, while the error text it would have printed claims it refuses "a chain that is already broken".
cd8d5d2dffaddb9c4e42e2ac5e51542bc8c63a9af3191adce8a9f928e77c187f#R3 no-script
VerifyLedgerDir has no notion of chain LENGTH or of an expected head, so deleting the newest k entry files from a ledger directory leaves a chain that verifies entirely clean — an unfavourable run can be erased with no residue, which the entry-file gzip's `nothing is ever rewritten` claim does not cover.
cd8d5d2dffaddb9c4e42e2ac5e51542bc8c63a9af3191adce8a9f928e77c187f#R4 no-script
An adjudication is accepted when the hash before its `#` names ANY earlier entry, not a review entry — `seen` holds every entry hash — so a KindAdjudication naming a scan entry plus an invented finding id passes EntryShapeProblem and VerifyLedgerDir and lands a corral_adjudications row whose review_uid joins to no review.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R2 no-script
sbom.yml's `attach-to-release` job can never fire for a release cut by release.yml, because that release is created with GITHUB_TOKEN and GitHub does not start workflow runs from GITHUB_TOKEN-created events — so the SBOM is not attached to any release, contradicting this workflow's own header.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R3 no-script
release.yml passes `--latest` unconditionally and never `--prerelease`, so a release-candidate tag such as v1.0.0-rc.11 is published as a full release and displaces any stable release as `Latest` — the exact 'the Releases page advertises the wrong build' failure this workflow was written to prevent.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R4 no-script
In deploy.yml's self-hosted deploy job, `git checkout -- internal/ui/console.manifest.sig` is reached only on the success path under `set -euo pipefail`, so any failure in signing, signature verification, or either `go build` leaves the production clone dirty and every subsequent deploy fails at `git pull --ff-only` — the failure mode the line's own comment says it exists to prevent.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R5 no-script
deploy.yml's deploy job builds whatever `git pull --ff-only` produces in ~/corralai and never compares HEAD to `github.sha`, so a clone left on a branch other than main deploys code that is not the pushed commit and reports a green deploy; and because `mv -f corral.new corral` overwrites the running binary before the health probe, a failed /healthz leaves the service down with no rollback target.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R6 no-script
self-audit.yml's comment claims the audit runs 'the corral of the commit we CHECKED OUT', but on a pull_request event actions/checkout checks out the merge ref while `corral-version` is `head.sha` — the binary doing the auditing is built from a different tree than the one being audited.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R7 no-script
self-audit.yml passes neither `attest` nor `ledger` to the action, so a self-audit budgeted at up to 340 minutes of paid model calls produces no signed statement, no attestation and no ledger entry — the action takes the `--no-ledger` branch and the run's only artifact is an ephemeral job summary.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R8 no-script
cla.yml's allowlist entry `bot*` is turned into an unanchored regular expression by contributor-assistant (as the file's own comment states patterns containing `*` become regexes), which would exempt any contributor login merely containing that stem from signing the CLA.
73b875458dcf2f9890b0838ab3e80b633d0f1251a90264d96ea51f5d5f519f60#R9 no-script
release.yml triggers on any `v*` tag push with no dependency on the validate workflow's result, so a tag placed on a commit whose CI is red or never ran publishes a release and marks it latest.
09b6b339405f83a44741b2fc83df2829d3614ad3da602d198f0960909de7b3ac#R2 no-script
concepts/memory-and-learning-loop.mdx states in the present tense that approved lessons are injected into later audit runs' task instructions ("capped at 3", fenced as LESSONS FROM THE HERD), but mission.InjectLessons — the function that does that — is called only from its own test file, and the sole production CreateMission caller (internal/brain/advpool.go:788) creates a one-phase tracking mission with no instruction and no lessons, so the loop's "active half" reaches no run today.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R4 no-script
PushLedgerDir stamps source_pushed = withSource on every scan entry it pushes, so `corral ledger push --push-source` records the custody claim "our code left the box" for entries that were written with source already blanked and therefore carry none.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R5 no-script
corral_findings has refutation_script and refutation_script_sha256 but no refutation_output column, so a warehouse reader can see the verifier's script and its exit code but never what it printed — the evidence for a demotion is unrecoverable, while the reviewer's own stdout IS stored.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R6 no-script
AppendLedgerEntry links a new entry to `existing[n-1].Hash` as stored, without recomputing it, so a push or `corral ledger append` onto a chain whose head has been edited extends and signs the tampered chain rather than refusing.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R7 no-script
Retracted() is built over every retraction entry including ones that have themselves been retracted, so retracting a retraction leaves the original entry still out of the record — there is no way to undo a mistaken retraction, and WriteRetraction accepts the attempt without saying so.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R8 no-script
CanonicalSparseJSON decodes without UseNumber, so every number in the warehouse-rows hash passes through float64 — the exact loss its sibling CanonicalFullJSON documents itself as avoiding — and two bundles differing only in an integer past 2^53 (token counts, millis) hash identically.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R9 no-script
pruneEmpty removes empty ELEMENTS from arrays rather than only empty keys, so a bundle whose Files/Mutants slice contains an all-zero row hashes to the same warehouse-rows value as one without that row — the sparse form is not injective over slice length.
55f0793d5e86b57f414102fe55592fa053d1bbdab7b935e43ae9bf4e263af9c0#R10 no-script
When a prune removal fails part-way, WriteCheckpoint returns pruned = 0 although entries have already been deleted, so `corral ledger checkpoint` prints "0 earlier entries pruned" for a directory it has partly emptied.
618e234b80386da9b25ec3f9ea3973a7bf82914dd0fc58a7fa0df3fb8e3b180a#R2 not-shown
open_session catches only BadSignature, but itsdangerous raises BadPayload (a sibling of BadSignature under BadData, not a subclass) when a correctly-signed cookie cannot be deserialized, so such a cookie propagates an exception out of session opening and turns every request from that client into a 500 instead of falling back to an empty session.
618e234b80386da9b25ec3f9ea3973a7bf82914dd0fc58a7fa0df3fb8e3b180a#R3 not-shown
get_cookie_path is annotated `-> str` and documented to fall back to '/' when APPLICATION_ROOT is None, but it actually returns None, and werkzeug then emits the session cookie with no Path attribute, scoping it to the requesting URL's directory rather than the whole site.
618e234b80386da9b25ec3f9ea3973a7bf82914dd0fc58a7fa0df3fb8e3b180a#R4 no-script
A cookie rejected by open_session (bad signature or expired) produces a fresh session with modified=False, so save_session's deletion branch at line 354-355 never fires and the unusable cookie is never cleared from the client, which after a SECRET_KEY rotation without fallbacks leaves every client re-sending a dead cookie indefinitely.
618e234b80386da9b25ec3f9ea3973a7bf82914dd0fc58a7fa0df3fb8e3b180a#R5 no-script
save_session calls get_signing_serializer(app) a second time and dereferences the result with only a type-ignore, so if app.secret_key becomes falsy between open_session and save_session the request dies with AttributeError on None rather than a meaningful error.
61dc210a39fd77be5806ba1c4e079686cdc4de11a99d18e616bfb3801605ef1d#R6 no-script
CoverageNote's blanket-approval rule is defeated by any finding at all: a review with one HYPOTHESIS finding and an empty sound list gets no coverage note, so "nothing here is evidence the scope is sound" is withheld from exactly the review that most needs it — one that executed nothing and listed nothing it checked.
61dc210a39fd77be5806ba1c4e079686cdc4de11a99d18e616bfb3801605ef1d#R8 no-script
tail() cuts on a byte boundary, so a reproduction whose output exceeds 4000 bytes and ends in multi-byte text is recorded with a truncated rune — invalid UTF-8 in the Stdout that the entry and the --attest statement carry as the run's evidence.
b3307bbbb5e65a5ca8a571d207eb460ca25aa079336faf48d1def708ba0abbd1#R5 no-script
The compile gate wraps the WHOLE chain of CompileCheck commands in ONE context bounded by perMutant (both on the compliant probe and per mutant), so a plugin with several check commands gives the later ones a shrinking budget, and a gate command that exhausts it returns an error which fails the entire report rather than being classified.
b3307bbbb5e65a5ca8a571d207eb460ca25aa079336faf48d1def708ba0abbd1#R6 no-script
Duplicate mutants inherit their representative's Duration into their own PerMutant entry, and mutantSpread computes the median over that map, so a set with N copies of one edit weights that one measured duration N times and reports a median no mutant's distribution supports.
e4bd04e8e47af317c213ae57944207dcc6da7fd85e5f236fabb61df3281b05a1#R1 no-script
A process crash during workspace-substrate mutation can leave the checkout mutated, and the next run has no durable journal with which to detect or restore that stale mutant, allowing results to be computed from an already-corrupted baseline.