Repository navigation
review(q7): verify unsafe GO in actual pinned XLSX, 25 engine cases [skip ci] - #696
Merged
Knapp-Kevin merged 1 commit intoNov 3, 2026
Conversation
Knapp-Kevin
pushed a commit
that referenced
this pull request
Nov 3, 2026
…ync public accounting [skip ci] Addresses PR #693 integration-HOLD review and cross-ledger defect comment. - Merged origin/main (post-#696); README retains #696 workbook acceptance links - Transferred the 4 previously-UNKNOWN package-tree SHAs (video-scoring-audio, design-concept-art-brief, scenario-storyboards, scenario-identity-library) from the pinned scanner receipts into the Q8 consumer ledger, after matching exact source pin, path and SKILL.md blob; Q7 UNKNOWN retained as history - Added dated Q8 checkpoint (39 methods / 28 domains) to docs/SYSTEM_STATE.md, INDEX.md and a current-shelf pointer in index.json; Q7 retained as history and its workbook caveat now points to merged #696 - Re-ran dashboard --self-test/--check; cross-checked 39-item ledger, 33-domain table, SVG and CSV; failed/incomplete scans and unaccepted false positives stay fail-closed; behavioral/adversarial acceptance remains NOT RUN Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0114De5q3RniVy9N6N5TiBuT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Q7 original pinned XLSX ACCEPTANCE: transfer blocker resolved; source false GO verified
Actual original source file, not synthetic. Transferred the exact
zicula/skills@ec7f94f84916be7bb25ec38752c24176330065a7grant-writing-kit/references/2-go-no-go/go-no-go-scorecard.xlsxbytes via GitHub connector Base64 into a private isolated container. Verified 10,048 bytes, Git blob SHA-1a58d34344847a73440cb8ded6be88a3e87cc093d, ZIP CRC integrity and 11 OOXML parts. Imported those exact bytes withartifact_tool.SpreadsheetFile.import_xlsx. Source file never exported or altered.Publisher's actual example fails: Its worksheet contains
Gates!B4=No. Re-entering unchangedScorecard!E2in the imported memory workbook triggered the originalF2:F16 → F17 → F18chain (original XLSX lacked cached formula values). The original weighted score is 76, yet the publishedF18returnsGO — commit the hours. An in-memory candidate formula referencing real answers inGates!B2:B7returns WAIT.Full controlled reproduction: 25/25 additional scenarios passed the candidate repair against the imported original publisher workbook, including No in every gate, blanks, unknowns, numeric/whitespace inputs, score thresholds 49/50/69/70, missing/text score, and reverse false WAIT when all B answers are Yes but narrative C2 contains
No. Original verdicts, expected candidate decisions, source hash and exact fidelity limitations recorded inregistry/discovery/q7-original-pinned-scorecard-engine-acceptance-20261103.json. Wrong-byte Git hash test correctly rejected a deliberately mutated file.Repository changes: Existing pinned harness
scripts/qa/check_pinned_grant_scorecard.pynow also verifies exact pinned source baseline 76/unsafe GO and runs 25 cases (fixture mode still clearly labeled synthetic); dated plain-English review, README, curation queue, system state, index and historical blocker docs updated. Existing 18/18 and 9/9 synthetic receipts remain preserved, with supersession markers. The original XLSX is not mirrored or patched in Skillz.Critical disposition: Transfer/execution blocker resolved, but the publisher's source is now empirically proven unsafe, not approved unchanged. Excel/LibreOffice interoperability, actual funder policy/financial-owner review and complete security clearance remain held. This adds qualification evidence, not a new Valuable Reference or approved installation. Current 20-method Q7 bounded shelf and 33-domain graph untouched. Claude's independent Q8 source reviews untouched.
[skip ci], no GitHub Actions pass claimed. Branch readback checks source pin, report 25/25, baseline 76, historical preservation and exactly nine changed files.