19 lines
1.0 KiB
Markdown
19 lines
1.0 KiB
Markdown
|
# Audit Bug Patterns in status.py
|
||
|
|
|
||
|
|
Recurring issues found during the 10-bug audit (2026-06-22).
|
||
|
|
|
||
|
|
## 1. Path prefix matching without separator boundary
|
||
|
|
`startswith(proj_str)` matches sibling directories (e.g. `/foo/project-evil` matches `/foo/project`). Always use `startswith(proj_str + os.sep)` with exact-match fallback.
|
||
|
|
|
||
|
|
## 2. Substring verdict parsing
|
||
|
|
Using `"PASS" in content` falsely matches PASS mentioned in FAIL body text. Always use structured parsing (e.g. `## Status:` line) before substring fallback.
|
||
|
|
|
||
|
|
## 3. mtime as activity proxy
|
||
|
|
`.state` file mtime reflects phase transitions, not actual edit activity. Use a separate `.state.lastedit` file touched on ALLOWED `--can-edit` responses for stale-task detection.
|
||
|
|
|
||
|
|
## 4. Artifact-to-phase mapping mismatches
|
||
|
|
TEST_PLAN.md is produced during `test_design`, not `implement`. Always cross-reference artifact filenames with the workflow phase that produces them.
|
||
|
|
|
||
|
|
## 5. Untracked task enforcement
|
||
|
|
Tasks without `.state` files must be refused by all operational commands. Run `--upgrade` to bootstrap them.
|