fix(audit): recompute status in merged render instead of serving stored verdict - #136
Merged
Merged
Conversation
…ed verdict local_state.json stores the status computed at collect time. merge_for_display served it verbatim while joining latest_version fresh from the upstream baseline — so when the committed baseline moved without a local re-collect, the row paired the new latest with a stale verdict. Field case: bwrap rendered "installed 0.9.0 / latest 0.11.2 / UP-TO-DATE", and guide.sh printed "target: 0.11.2 (same); up-to-date; skipping.". Recompute the status from the current (installed_version, latest_version) pair at merge time, directional like compute_status (installed >= latest is UP-TO-DATE). CONFLICT passes through; missing either side keeps the stored status. The legacy tools_snapshot.json picks up correct verdicts on the next update/update-local rebuild. Claude-Session: https://claude.ai/code/session_01MH3EaniXCnJdwqNvrMB4Ym Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Real field output from
make upgrade:0.9.0reported as "(same)" as0.11.2. Root cause chain, each step verified live:compute_status("0.9.0", "0.11.2")is correct (OUTDATED) — comparison logic is not at fault.merge_for_display(cli_audit/local_state.py) built display rows with"status": loc.status— the verdict stored inlocal_state.jsonat collect time — while joininglatest_versionfresh from the upstream baseline.tools_snapshot.json(row containedlatest_version: 0.11.2+status: UP-TO-DATEsimultaneously),audit.pyderivedis_up_to_datefrom it, andguide.shprinted "(same) / up-to-date; skipping".Fix
_display_status()recomputes the verdict from the current(installed_version, latest_version)pair at merge time — directional likecompute_status(installed ≥ latest is UP-TO-DATE, handles installed-ahead-of-stale-baseline).CONFLICTpasses through; a missing side keeps the stored status (best available information). A stored derived value is only valid for the inputs it was computed from.Test plan
audit.py --update-local, the snapshot row andCLI_AUDIT_JSON=1 audit.py bwrapboth reportOUTDATED/is_up_to_date: falsefor 0.9.0 vs 0.11.2.https://claude.ai/code/session_01MH3EaniXCnJdwqNvrMB4Ym