From efa701279fe54d2c7935e2bda170bd2960c88c3c Mon Sep 17 00:00:00 2001 From: weichen Date: Mon, 5 Oct 2026 10:48:31 +0000 Subject: [PATCH] Fix evidence CMD quoting and record first tool self-tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: the make-variable pass-through re-quoted CMD and broke any command containing quotes (caught by the redaction self-test before it could run). Evidence: redaction self-test now records 'token hello' with quoting intact (row sha256 aae6a895); negative 'false' case earlier recorded exit=1 row and propagated rc — both in the task card evidence table. Impact: CMD now travels via environment (CMD="..." make evidence); SRC/TAIL stay make variables; usage strings updated in Makefile/AGENTS.md/task.sh template comment. Refs: task card evidence table; guidelines draft.10 tool-written-evidence rule. --- .task/feature-evidence-driven-gates.md | 22 ++++++++++++++++++++++ AGENTS.md | 2 +- Makefile | 6 +++--- scripts/evidence.sh | 3 ++- scripts/task.sh | 2 +- 5 files changed, 29 insertions(+), 6 deletions(-) diff --git a/.task/feature-evidence-driven-gates.md b/.task/feature-evidence-driven-gates.md index a4c1e583..c18ba60e 100644 --- a/.task/feature-evidence-driven-gates.md +++ b/.task/feature-evidence-driven-gates.md @@ -35,3 +35,25 @@ review 技能文本改造（后续任务）。 - 结果： - 验证： - 影响与剩余项： + +## 证据（Evidence） + + +| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) | +|---|---|---|---|---|---| +| 2026-10-05T10:47:37Z | `false` | ba83a17c11 | 1 | SELF | e3b0c44298fc1c14 | + + +``` +$ false +[exit 1 | HEAD ba83a17c11 | sha256:e3b0c44298fc1c14] 输出尾部 15 行： + +``` +| 2026-10-05T10:48:16Z | `printf 'token 0123456789abcdef0123456789abcdef01234567 hello\n'` | ba83a17c11 | 0 | SELF | aae6a8955c582b4b | + + +``` +$ printf 'token 0123456789abcdef0123456789abcdef01234567 hello\n' +[exit 0 | HEAD ba83a17c11 | sha256:aae6a8955c582b4b] 输出尾部 15 行： +token hello +``` diff --git a/AGENTS.md b/AGENTS.md index 2c5a7086..3860b148 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -45,7 +45,7 @@ - **来源三分**：产出物（任务卡、PR、报告、review 结论）中的通过类断言须标注来源—— `GATE`（CI/分支保护/precheck 实测）/ `REPLAY`（审阅者独立重跑）/ `SELF`（作者粘贴）。 合入与验收判定只认 GATE/REPLAY；SELF 仅为线索，与重验不一致时以重验为准。 -- **证据由工具写入**：命令输出进入任务卡/PR 一律经 `make evidence CMD="…"` 写入 +- **证据由工具写入**：命令输出进入任务卡/PR 一律经 `CMD="<命令>" make evidence` 写入 （自动记录命令、被测 HEAD、退出码、输出 sha256 与尾部摘录并脱敏 token）。手抄、转写、 凭记忆重构的输出视为无效证据；补写输出与伪造测试同级红线。 - **完成声明三段输出**（precheck / task-sync / 测试）必须由 evidence 工具写入任务卡， diff --git a/Makefile b/Makefile index 844ab48f..94a08629 100644 --- a/Makefile +++ b/Makefile @@ -42,10 +42,10 @@ task-finish: @bash $(TASK) finish $(ABANDON) # 证据写入：执行命令并把结果行追加进当前任务卡（AGENTS.md「证据与验证门禁」）。 -# 用法：make evidence CMD="<单行命令>" [SRC=SELF|REPLAY|GATE] [TAIL=15]；退出码随被执行命令。 +# 用法：CMD="<单行命令>" make evidence [SRC=SELF|REPLAY|GATE] [TAIL=15]；退出码随被执行命令。 +# CMD 经环境直传（不经 make 变量展开重引号，命令内可含引号/管道）；SRC/TAIL 为简单词，走 make 变量。 evidence: - @test -n "$(CMD)" || (echo 'usage: make evidence CMD="" [SRC=SELF|REPLAY|GATE] [TAIL=15]'; exit 2) - @CMD='$(CMD)' SRC='$(SRC)' TAIL='$(TAIL)' bash scripts/evidence.sh + @SRC='$(SRC)' TAIL='$(TAIL)' bash scripts/evidence.sh # 外部事实登记表逐条重验（--update 刷新 PASS 项 last_verified）。 facts-verify: diff --git a/scripts/evidence.sh b/scripts/evidence.sh index 7b3e7163..a600ab0f 100755 --- a/scripts/evidence.sh +++ b/scripts/evidence.sh @@ -2,7 +2,8 @@ # 证据写入工具：执行命令，把（命令、被测 HEAD、退出码、输出 sha256、尾部摘录、时间、来源） # 追加到当前分支任务卡的「## 证据（Evidence）」表。规范依据：AGENTS.md「证据与验证门禁」、 # guidelines standards/verification.md「声明与证据来源」——转写/手抄的输出视为无效证据。 -# 用法：make evidence CMD="<单行命令>" [SRC=SELF|REPLAY|GATE] [TAIL=15] +# 用法：CMD="<单行命令>" make evidence [SRC=SELF|REPLAY|GATE] [TAIL=15] +# （CMD 经环境变量直传；也可直接 CMD=… SRC=… TAIL=… bash scripts/evidence.sh） # 退出码 = 被执行命令的退出码（失败可见），证据行无论成败都会写入。 set -uo pipefail diff --git a/scripts/task.sh b/scripts/task.sh index 12217377..073a4f60 100755 --- a/scripts/task.sh +++ b/scripts/task.sh @@ -150,7 +150,7 @@ cmd_start() { ## 证据（Evidence） - + | 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) | |---|---|---|---|---|---|