Build Log

The Scan That Found Bugs in the Scanners

August 16, 2026

Dispositioned 3 cross-session governance findings, reframed the scanner's whole thesis from recurrence-counting to control-erosion detection, then found and fixed 10 real measurement bugs across 6 governance scripts — several inside the very session that was fixing them.

ForgeKit OSGovernanceTestingCrucible

real governance-script bugs found and fixed, all independently verified against real data

distinct measurement bugs found in one script (cross-session-scan.mjs) before the real Crucible Checkpoint number was trustworthy

60/125

verified rate of Crucible Checkpoint omissions since the mechanism existed (48%) — the honest number, after 3 corrections

new/updated regression tests added across 7 test files, all passing

Timeline

Start

Charge: disposition 3 undispositioned cross-session-scan.mjs findings

Session Close Gate escape hatch 55/239, Crucible Checkpoint skip 10/239, OS debt acceptance 19/239 — deferred from the prior incident-response session

Crucible

Ran the Council (architect/qe/steward) on the Charge, then Zeb reframed it

Council said 'disposition each pattern tonight'; Zeb's reframe: recurrence isn't the signal, control erosion is — three different failure shapes (control omission, exception normalization, accepted-debt persistence) were being measured identically

Redesign

Rewrote cross-session-scan.mjs around the 3 signal types, hard-failed the Crucible Checkpoint gap in build-session.mjs

Reported 197/239 omissions — Zeb disputed it on gut instinct ('I remember dealing with the crucible question a lot')

Self-correction

Traced the disputed number through 3 real bugs in my own new code before trusting it

Bug 1: required asked:true in addition to a real answer, wrongly flagging honest asked:false skips. Bug 2 (after fixing #1): still wrong at 174 — no floor date, penalizing 114 sessions that predate the mechanism's 2026-07-02 introduction. Final verified number: 60/125 (48%)

Fix

Fixed the SAME asked:true bug living unfixed in build-session.mjs itself — caught by a test I wrote for the new hard-fail, not by inspection

The fix I'd applied to my new scanner never touched the original site

Audit

Ran a 2-phase Workflow (5 script clusters, adversarial verify per finding) hunting the same bug class across the rest of the OS's governance scripts

Round 1 (2/5 clusters, rate-limited): 3 confirmed findings. Round 2 (resumed, all 5 clusters): 13 more confirmed, 5 correctly refuted as already-fixed

Fix

Applied all 5 high-severity confirmed findings: spin-categories.mjs (token/ticket/dep false positives), verify-reuse.mjs (single-consumer-only check + a .json-false-match bug the fix itself surfaced), engine-guard.mjs (multi-section citation regex)

Verified each fix against real historical sessions, not just synthetic fixtures

76 tests across 7 files, full test:os suite green, 4 medium/low findings logged as nextItems rather than rushed

What shipped

forgekit-os/scripts/cross-session-scan.mjs — rewritten around 3 signal types (control_omission, exception_normalization, accepted_debt_persistence) instead of one flat recurrence-threshold; each field now declares signalType + optional introducedDate

forgekit-os/scripts/build-session.mjs — promoted the Crucible Checkpoint warn-only check to a hard-fail (versioned via gate_accounting_policy: canonical-v1); fixed the crucibleRecorded AND postBuildCrucibleRecorded predicates (both required asked:true in addition to a real answer); SESSION_CLOSE_EXEMPT_PATHS now imports DIFF_EXCLUDE instead of a stale, independently-drifting duplicate

forgekit-os/scripts/gate-registry.mjs — resolveGateId() now prefix-matches a known gate name followed by a real separator, fixing real historical sessions whose gates_run evidence was written as natural sentences ('Schema Gate (marker written and refreshed twice...)') and would otherwise hard-fail

forgekit-os/scripts/spin-categories.mjs — 'token'/'ticket' keywords in Auth & Identity required real auth co-occurrence (were matching LLM token budgets, Next.js route params, Alloy's internal build-ticket vocabulary); 'dep' expanded to 'dependenc' plus explicit deploy-related keywords (was accidentally matching inside 'deploy'/'deploys')

forgekit-os/scripts/verify-reuse.mjs — Consumers-cell regex changed from single .match() to .matchAll() so every claimed consumer in a multi-consumer CANONICAL/COMPOUNDING row is checked, not just the first; fixed a .json-false-matching-as-.js bug the matchAll fix surfaced; corrected the header comment's overclaimed 'grep the actual import statement' capability to describe what's actually checked (file existence only)

forgekit-os/scripts/engine-guard.mjs — gate-section-citation regex no longer swallows a second real '§Section' when two sections are cited together via '+'; each cited section is now checked against both gates.md and gates-specialized.md independently, not just the file named in the artifact string's own prefix

forgekit-os/scripts/tests/cross-session-scan.test.mjs, engine-guard.test.mjs, verify-reuse.test.mjs — new test files (14, 2, 5 tests)

forgekit-os/scripts/tests/build-session.test.mjs, build-session-gate-audit.test.mjs, gate-registry.test.mjs, spin-categories.test.mjs — extended with regression tests for every fix above

forgekit-os/cross-session-findings.json — 3 findings honestly dispositioned: Pattern 1 (Session Close Gate) insufficient_signal, Pattern 2 (Crucible Checkpoint) confirmed_control_miss at the verified 60/125 rate, Pattern 3 (OS debt) confirmed_normalizing_debt (already resolved by the prior session's ignition.md split)

forgekit-os/journal/strikes.md + anvils.md — Strike/Anvil pair: 'Recurrence is not the signal ForgeKit cares about — control erosion is'

“one note. from my recollection, I remember dealing with the crucible question a lot. 197 seems oddly high to me”
— Zeb, disputing a number with no counter-evidence offered — correct on gut instinct, three real bugs deep