Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/fix-guard-test-blindspot-coverage.md; R0=7a5c80eacb835bfc6e62b3557129ec299bbb5290.
Impact: task metadata only; the feature workspace starts at 7a5c80eacb.
Refs: .task/fix-guard-test-blindspot-coverage.md
Why: three BLOCKED review rounds and their closures, plus the final PASS, must
be recorded before delivery.
Evidence: /tmp/guard-blindspot-impl-r2-20261020.json, /tmp/guard-blockers-r2-receipt-20261020.json,
/tmp/guard-closure-receipt2-20261020.json (all cursor, success) and
/tmp/guard-closure-review-receipt-20261020.json (pi-glm, PASS);
review reports under .task/reviews/.
Impact: card metadata only; no behaviour change.
Refs: fix/guard-test-blindspot-coverage
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=210f8f305238a0241ce69ab5943b52d8bc5bcc62.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: close the task card inside its own PR so landing it needs no post-merge backfill or separate close PR.
Evidence: .task/fix-guard-test-blindspot-coverage.md -> .task/archive/fix-guard-test-blindspot-coverage.md; status 已完成（合入前闭合）; PR #671https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/671.
Impact: task metadata only; the card is archived within PR #671 and lands with its merge commit.
Refs: task.sh close --self
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=8f59b135ec27fc04e432583d70e1e1d0d6f25ea8.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
fix/guard-test-blindspot-coverage 任务卡
任务主记录：<PR 链接，交付前填写>；状态：进行中；owner：weichen
权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）=
7a5c80eacb工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-guard-test-blindspot-coverage（worktree）；分支：fix/guard-test-blindspot-coverage
分支类型：standalone；root_target：main；immediate_target：main；accepting_requirements：false
需求分流：verdict=NEW；selected_initiative=无；requirement_sha256=d069a788b17d9bf644b3c362332b1557d44ea9966a6e2aa8d670dbe426d7ba3b；triage_receipt=/tmp/triage-guard-blindspots-20261020.json；receipt_sha256=f5b6947b7b39a1318e36fd5ba9e837cc6c67087c565badcb6b8bff3743ae4e5c
授权与交付终点：加固 PR #664 遗留的两项——守护测试只覆盖管道末级（中段
| head、awk exit、| read、前缀化 grep 是盲区）与硬编码受管脚本清单；改为按 git ls-files 自动发现 + 覆盖任意非首级早退读取器，并修复因此暴露的脚本写法。按现行门禁完成 Review、PR、CI、合入与回收。不得改动脚本语义与退出码、不得新增豁免压制发现、不得改 Makefile/CI/子模块/规范文档。交付模式：goal-first（目标、范围和交付终点一次确认；范围内连续推进）
实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
流程依据：仓库根目录 policy/delivery.md（归档后仍按仓库根目录定位）
目标与非目标
目标：
tests/test_shell_pipe_hazard.py从「只看管道末级 + 硬编码 6 个脚本」升级为「任意非首级早退读取器 + git ls-files 自动发现全部受管脚本」，并由READER_FAMILIES显式声明守护契约（7 族：grep -q/-m、head、sed q/Q、awk exit/nextfile、read、mapfile/readarray -n、while/until/select 循环），每族必有合成自检。随之修复被新检测暴露的脚本写法。非目标：不改变任何脚本的行为、退出码与调用顺序；不新增豁免列表压制发现；不改 Makefile、CI、子模块 pin、共享规范子模块与文档；不追求穷尽 bash 全部构造（契约是已声明族全覆盖且可扩展，族外命令只作非阻塞观察）。
验收条件：(1) 守护测试全绿且可证伪；(2) 受管脚本自动发现（含无扩展名脚本与 docker/*.sh）且 0 误报 0 解析错误；(3)
make test-governance全绿；(4) 独立 Review 无未闭合阻塞项。Agent 实施收据
路由与 fail-stop 规则见根目录 AGENT-EXECUTION.md 与 policy/delivery.md；每次尝试一行，原始日志留在源码外收据路径。
scripts/e2e-duties.sh不在允许路径，host 记录最小扩围理由后重发）8803bea)/tmp/guard-blindspot-impl-r2-20261020.json（r1：/tmp/guard-blindspot-impl-r1-20261020.json）.task/reviews/2026-10-20-guard-test-blindspot-review.md/tmp/guard-blindspot-review-r2-20261020.jsontests/test_shell_pipe_hazard.py22dd375)/tmp/guard-blindspot-repair-r1-20261020.json/tmp/guard-blindspot-rereview-r1-20261020.jsontests/test_shell_pipe_hazard.py6ddbae0)/tmp/guard-blockers-r2-receipt-20261020.json/tmp/guard-final-review-receipt-20261020.jsontests/test_shell_pipe_hazard.pyfcdf57f)/tmp/guard-closure-receipt2-20261020.json.task/reviews/2026-10-20-guard-test-blindspot-closure-review.md0871681)/tmp/guard-closure-review-receipt-20261020.json同步记录
7a5c80eacb7a5c80eacb证据（Evidence）
结果与验证（完成后填写）
scripts/task、scripts/dm、scripts/agent-exec等无扩展名脚本与docker/entrypoint.sh）」，并由READER_FAMILIES显式声明 7 族契约、每族必有合成自检。随之修复 4 处被新检测暴露的写法：scripts/e2e-duties.sh:87（ps … | grep -Fq）、:128（curl … | head -c 160）、scripts/hooks/pre-commit:9（echo "$branch" | grep -qE）、scripts/svc.sh的pgver（postgres --version | awk … exit）。make test-governance526 项 OK（18 skipped）；三轮独立评审的 6 个阻塞项（子壳/花括组包裹、awk nextfile、while read break、绝对路径与 exec 前缀、mapfile/readarray -n 与 read -n、until 条件读取与循环体 exit）逐一修复并经终审独立复核通过，运行时 141 实证随每族自检固化在测试里。pre-commit写路径守卫的 13 组分支名）。非阻塞：族外命令（dd、jq -n、perl -ne、xargs -n1）与sed -f/awk -f外部程序文件不在契约内，只作观察；守护契约以已声明族为界，新增族需同步更新READER_FAMILIES与自检。合入与清理
08716814cee11bb95aca4ac88f137b4738cfe39f；报告.task/reviews/2026-10-20-guard-test-blindspot-closure-review.md；重放依据：host 独立跑守护测试、make test-governance、bash -n 与发现清单核对）