| 162 | 2026-10-28 08:02 UTC |
scan |
|
verified
|
| 161 | 2026-10-27 08:07 UTC |
scan |
|
verified
|
| 160 | 2026-10-26 20:10 UTC |
scan |
|
verified
|
| 159 | 2026-10-21 17:44 UTC |
scan |
|
verified
|
| 158 | 2026-10-21 17:43 UTC |
scan |
|
verified
|
| 157 | 2026-10-21 15:49 UTC |
scan |
|
verified
|
| 156 | 2026-10-19 22:53 UTC |
scan |
|
verified
|
| 155 | 2026-10-19 22:53 UTC |
scan |
|
verified
|
| 154 | 2026-10-19 22:53 UTC |
scan |
|
verified
|
| 153 | 2026-10-19 22:53 UTC |
scan |
|
verified
|
| 152 | 2026-10-19 22:53 UTC |
scan |
|
verified
|
| 151 | 2026-10-19 22:53 UTC |
scan |
|
verified
|
| 150 | 2026-10-19 20:20 UTC |
scan |
|
verified
|
| 149 | 2026-10-19 20:20 UTC |
scan |
|
verified
|
| 148 | 2026-10-19 20:20 UTC |
scan |
|
verified
|
| 147 | 2026-10-19 20:20 UTC |
scan |
|
verified
|
| 146 | 2026-10-19 20:20 UTC |
scan |
|
verified
|
| 145 | 2026-10-19 20:20 UTC |
scan |
|
verified
|
| 144 | 2026-10-14 13:37 UTC |
scan |
|
verified
|
| 143 | 2026-10-09 15:25 UTC |
adjudication |
confirmed 786e8a0c675e#R2 by pdbethke: real, low, checked by reading main b6638031: ledgerdir.go:656-657 puts the 'signer name is self-reported' caveat into c.Note for pre-corral-ledger-4 signed entries; ui_ledger.go:123 (and :125) overwrite u.Note with the retraction text while uiweb/index.html:178 still renders 'verified · <keyid>', so the caveat is lost exactly on retracted legacy entries. |
verified
|
| 142 | 2026-10-09 15:25 UTC |
adjudication |
confirmed 786e8a0c675e#R1 by pdbethke: real, low not medium, checked by reading main b6638031: readUILedger reads the directory twice (VerifyLedgerDir, then readLedgerRecord) and pairs checks to entries by index (ui_ledger.go:105-109) without comparing ChainCheck.Hash to e.Hash. On an append-only ledger the realistic race is an entry appended between reads rendering as unsigned with no Problem counted; a stale SigOK on different bytes needs a rewrite in that window. Matching by hash closes both. |
verified
|
| 141 | 2026-10-09 15:25 UTC |
adjudication |
confirmed e1608f971235#R4 by pdbethke: real, low, checked by reading main b6638031: writeAuditStatement discards signErr (certify_repo.go:5103, sha, _, _, err), which is right for a plain --attest run but loses the real cause on --transparency, where the operator then sees only 'reading the signed envelope … no such file'. The computed-then-dropped diagnostic shape AGENTS.md names. |
verified
|
| 140 | 2026-10-09 15:25 UTC |
adjudication |
confirmed e1608f971235#R3 by pdbethke: real, low, checked by reading main b6638031: writeStatement writes the plain file before removing the stale envelope (certify_repo_transparency.go:156-160) and returns sha='' on a removal failure, so the runner is told 'nothing will be attested and no rows were pushed' while action.yml's predicate step finds a non-empty statement and attests it. Needs an unremovable envelope path to trigger. |
verified
|
| 139 | 2026-10-09 15:25 UTC |
adjudication |
confirmed e1608f971235#R2 by pdbethke: real, checked by reading main b6638031: a failed statement write (certify_repo.go:1450) and a failed push (:1549) raise ::warning under GITHUB_ACTIONS; the --transparency failures (the transparencyPublicKeyPEM branch at :1466 and uploadToTransparencyLog) print one plain stderr line, so a requested-but-failed public log entry leaves a green job and NULL receipt columns. A rule at two doors and not the third. |
verified
|
| 138 | 2026-10-09 15:25 UTC |
adjudication |
confirmed e1608f971235#R1 by pdbethke: real, reproduced, recheck on main b6638031: still-reproduces. A CORRALAI_CERTIFY_KEY_FILE naming a missing path goes straight to LoadOrCreateSigningKey and mints a key; the doc comment calls that a deliberate bootstrap, but the --transparency help (certify_repo.go:90) promises it 'never mints a fresh key just to have one', and on that flag the minted identity signs into a public, permanent log. The promise and the code disagree; for a permanent log the code should change, not the text. |
verified
|
| 137 | 2026-10-09 15:25 UTC |
adjudication |
confirmed b3e2ec973c76#R1 by pdbethke: real, reproduced, recheck on main b6638031: still-reproduces. Open calls credsDir first and returns its error before envBackend is in the chain (creds.go:213-217), so with HOME, XDG_CONFIG_HOME and CORRAL_CREDS_DIR unset an env-only key cannot be resolved — contrary to Open's own 'a missing store is not an error'. Uncommon environment (HOME-less containers/CI), hence real but narrow. |
verified
|
| 136 | 2026-10-09 15:25 UTC |
adjudication |
confirmed f5015cf48e54#R4 by pdbethke: real, latent, low, reproduced, recheck on main b6638031: still-reproduces. A NaN/Inf rawDurationS reaches stepHash's json.Marshal and panics inside a function that returns error; no current caller can produce one (both read JSON), so it is a contract gap, not a live crash. |
verified
|
| 135 | 2026-10-09 15:25 UTC |
adjudication |
refuted f5015cf48e54#R3 by pdbethke: not a defect, agreeing with the verifier: signbuild.go:35-39 documents that rawDurationS is the one duration input and that SignBuild sets rec.DurationS itself so the two cannot disagree; both callers leave rec.DurationS unset. The test passing it redundantly is untidy, not a lost measurement. |
verified
|
| 134 | 2026-10-09 15:25 UTC |
adjudication |
confirmed f5015cf48e54#R2 by pdbethke: real, reproduced, recheck on main b6638031: still-reproduces. No non-test code sets StartedTS/FinishedTS, SignBuild stamps no time, so every record through certify_change.go:111 and brain/buildcert.go:98 signs startedOn 0, finishedOn 0 and step ts 0 — a signed claim the build ran at the Unix epoch, visible in site/public/records/record-29.json. |
verified
|
| 133 | 2026-10-09 15:25 UTC |
adjudication |
confirmed f5015cf48e54#R1 by pdbethke: real, reproduced, recheck on main b6638031: still-reproduces. SignBuild's execution step writes duration_s: rawDurationS unconditionally (signbuild.go:60), so an unmeasured run's hash-linked step signs 0 while the statement omits it — the 167dd45b25cc R1 rule held at the statement door and the certify --local door (advpool/gate.go signedDurationS) but not this one. One correction to the claim: the test comment it calls false describes the certify --local step, which does omit; it is this door that does not. |
verified
|
| 132 | 2026-10-09 15:25 UTC |
adjudication |
confirmed e5fd4c8d1b50#R1 by pdbethke: real, low not medium, checked by reading main b6638031: pubkey.go:26/:29 TrimSpace before the emptiness test, so CORRALAI_LEDGER_PUBKEY=' ' resolves to no key and never reaches parseLedgerPubKey — against the function's own doc ('a malformed key from either source is an error … whoever set it meant to check'). Severity lowered because the downgrade is not silent: verify prints 'signature NOT CHECKED' on every signed entry. |
verified
|
| 131 | 2026-10-08 22:34 UTC |
review |
review of cmd/corral/ui_ledger.go by codex:gpt-6-astra: 0 reproduced, 2 code-read, 0 hypothesis |
verified
|
| 130 | 2026-10-08 22:33 UTC |
review |
review of cmd/corral/certify_repo_transparency.go by claude-code:claude-fable-5-1: 1 reproduced, 3 code-read, 0 hypothesis |
verified
|
| 129 | 2026-10-08 22:28 UTC |
review |
review of internal/creds/creds.go by codex:gpt-6-astra: 1 reproduced, 0 code-read, 0 hypothesis |
verified
|
| 128 | 2026-10-08 22:26 UTC |
review |
review of internal/certify/signbuild.go by claude-code:claude-fable-5-1: 3 reproduced, 1 code-read, 0 hypothesis |
verified
|
| 127 | 2026-10-08 22:22 UTC |
review |
review of internal/auditpush/pubkey.go by codex:gpt-6-astra: 0 reproduced, 1 code-read, 0 hypothesis |
verified
|
| 126 | 2026-10-07 21:37 UTC |
adjudication |
confirmed 8be2189163b0#R7 by pdbethke: real, and now FIXED: fixed in #359 (322429ca): a head with two checks has two answers (ListBySHA), and each status links to its own check. Execution on main 150127f5 (2026-10-07): TestListBySHAReturnsEveryCheck, TestEachStatusLinksToItsOwnCheck (internal/gate), TestGateRunWithoutAContextPassesOnlyIfEveryCheckPassed and TestGateRunForOneContextAnswersForThatCheck (internal/brain) pass. |
verified
|
| 125 | 2026-10-07 21:37 UTC |
adjudication |
confirmed 8be2189163b0#R6 by pdbethke: real, and now FIXED: fixed in #359 (322429ca): the stray-field guard matches any case after a comma and a field at a line start. Execution on main 150127f5 (2026-10-07): TestAStrayFieldIsCaughtAfterACommaInAnyCaseAndAtALineStartInLowercase passes. |
verified
|
| 124 | 2026-10-07 21:37 UTC |
adjudication |
confirmed 8be2189163b0#R5 by pdbethke: real, and now FIXED: fixed in #359 (322429ca): migrateKey runs in one transaction, and OpenStore repairs either interrupted state left by an older binary. Execution on main 150127f5 (2026-10-07): TestAMigrationInterruptedAfterCreateIsRetried, TestAMigrationInterruptedAfterDropKeepsItsHistory and TestAMigrationInterruptedBeforeRenameIsFinished pass. |
verified
|
| 123 | 2026-10-07 21:36 UTC |
adjudication |
confirmed 8be2189163b0#R4 by pdbethke: real, and now FIXED: fixed in #359 (322429ca): net= takes a boolean (strconv.ParseBool) and refuses anything else, as timeout= does. Execution on main 150127f5 (2026-10-07): TestNetRefusesAValueItDoesNotUnderstand passes. No recorded script (CODE-READ); the regression test is the evidence. |
verified
|
| 122 | 2026-10-07 21:36 UTC |
adjudication |
confirmed 8be2189163b0#R3 by pdbethke: real, and now FIXED: fixed in #359 (322429ca): cmd= is found with the same whitespace tolerance as every other field. Execution on main 150127f5 (2026-10-07): corral review recheck of this finding's own script -> no-longer-reproduces (ParsePolicy("repo=o/r, cmd=true") now returns the command, reason empty); TestASpaceBeforeCmdIsStillACommand passes. |
verified
|
| 121 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 61ecf250c4b4#R2 by pdbethke: real, reproduced: overlaying through a dangling symlink created the target and restore deleted the link, on pass=true, err=nil. The reviewer's script exited 0. Fixed in #346 (applyFiles refuses a dangling symlink before writing); TestWorkspaceRunnerRefusesToOverlayThroughADanglingSymlink failed on main first. |
verified
|
| 120 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 61ecf250c4b4#R1 by pdbethke: real, reproduced: Score's dedupe ignored WithCommandFor, so a mutant that survived its own command inherited its twin's kill. The reviewer's script exited 0. Fixed in #346 (dedupe key is edit + grading command); TestScoreDoesNotShareAVerdictAcrossDifferentGradingCommands failed on main first. |
verified
|
| 119 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 8be2189163b0#R7 by pdbethke: real, checked by reading main d75d2f20: GetBySHA selects ORDER BY ran_at DESC LIMIT 1 across all contexts, and the brain's /api/gate/run endpoint answers with that row's Passed. With two policies it can report a pass for a head whose other check failed. Not yet fixed. |
verified
|
| 118 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 8be2189163b0#R6 by pdbethke: real, checked by execution on main d75d2f20: 'cmd=true,Base=release' and 'cmd=true<newline>base=release' are both accepted with Base=[] (every branch) and the field swallowed into the command. Not yet fixed. |
verified
|
| 117 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 8be2189163b0#R5 by pdbethke: structure confirmed by reading main d75d2f20: migrateKey runs CREATE/INSERT/DROP/RENAME as separate db.Exec calls in a loop with no transaction. The crash consequences are the reviewer's argument and were not reproduced. Not yet fixed. |
verified
|
| 116 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 8be2189163b0#R4 by pdbethke: real, checked by execution on main d75d2f20: ParsePolicy("repo=o/r,net=True,cmd=true") returns AllowNet=false with no complaint, while a bad timeout= is refused. Not yet fixed. |
verified
|
| 115 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 8be2189163b0#R3 by pdbethke: real, reproduced, still open: re-checked on main d75d2f20 — ParsePolicy("repo=o/r, cmd=true") is refused as 'no cmd=', so a space after the comma turns that repo's gate off with only a log line. Not yet fixed. |
verified
|
| 114 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 8be2189163b0#R2 by pdbethke: real, reproduced: an undelivered status was retried by re-running Run, appending a new signed record every tick while the forge refused. Fixed in #347: a row with a signed record (RecordID != 0; build ids start at 1) is re-posted by Runner.Redeliver and never re-run; TestASignedVerdictIsRedeliveredNotRecertified failed on main first. |
verified
|
| 113 | 2026-09-24 13:07 UTC |
adjudication |
confirmed 8be2189163b0#R1 by pdbethke: real, reproduced, high: two policies for one repo that omit context= both became corral/gate, so the second never ran and the first's status stood in for it. Fixed in #347: ParsePolicyEnv refuses the second and the poller holds the same rule; the tests failed on main first, and a negative control shows the poller test fails without the guard. |
verified
|
| 112 | 2026-09-24 13:07 UTC |
adjudication |
confirmed a2a3af29d0c0#R1 by pdbethke: real, reproduced: toEntry accepted an empty inclusion proof, so Anchor succeeded and anchored=true was recorded for an entry VerifyInclusion rejects. The reviewer's script exited 0 and the verifier failed to refute it. Fixed in #347 (toEntry now calls parseInclusionProof); TestAnchorRefusesAnEmptyInclusionProof failed on main before the fix. |
verified
|
| 111 | 2026-09-24 00:31 UTC |
review |
review of internal/adequacy by codex:gpt-6-astra: 2 reproduced, 0 code-read, 0 hypothesis |
verified
|
| 110 | 2026-09-15 13:12 UTC |
review |
review of internal/gate by claude-code:claude-fable-5-1: 3 reproduced, 3 code-read, 1 hypothesis |
verified
|
| 109 | 2026-09-15 13:09 UTC |
review |
review of internal/transparency by codex:gpt-6-astra: 1 reproduced, 0 code-read, 0 hypothesis |
verified
|
| 108 | 2026-09-12 16:56 UTC |
review |
review of internal/transparency by claude-code: 3 reproduced, 5 code-read, 0 hypothesis |
verified
|
| 107 | 2026-09-12 16:48 UTC |
review |
review of internal/gate by antigravity: 4 reproduced, 1 code-read, 0 hypothesis |
verified
|
| 106 | 2026-09-12 16:07 UTC |
review |
review of internal/gate by claude-code: 6 reproduced, 2 code-read, 0 hypothesis |
verified
|
| 105 | 2026-09-12 16:00 UTC |
review |
review of internal/transparency by codex: 1 reproduced, 1 code-read, 0 hypothesis |
verified
|
| 104 | 2026-09-09 01:13 UTC |
review |
review of internal/sandbox by antigravity:claude-opus-4-6-thinking: 0 reproduced, 4 code-read, 1 hypothesis |
verified
|
| 103 | 2026-09-09 00:59 UTC |
review |
review of internal/adequacy by antigravity:gemini-3.1-pro-high: 1 reproduced, 0 code-read, 0 hypothesis |
verified
|
| 102 | 2026-09-08 21:46 UTC |
review |
review of internal/fence by antigravity:gemini-3.1-pro-high: 1 reproduced, 0 code-read, 0 hypothesis |
verified
|
| 101 | 2026-09-08 21:35 UTC |
review |
review of internal/fence by antigravity:gemini-3.1-pro-high: 1 reproduced, 1 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 100 | 2026-09-08 21:14 UTC |
review |
review of internal/advpool by claude-code: 2 reproduced, 3 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 99 | 2026-09-08 21:04 UTC |
review |
review of internal/reposcan by claude-code: 3 reproduced, 2 code-read, 1 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 98 | 2026-09-08 20:35 UTC |
review |
review of action.yml by claude-code: 2 reproduced, 3 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 97 | 2026-09-08 20:25 UTC |
review |
review of cmd/corral/certify_repo.go by claude-code: 2 reproduced, 3 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 96 | 2026-09-08 20:18 UTC |
review |
review of internal/auditpush by claude-code: 2 reproduced, 3 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 95 | 2026-09-08 19:17 UTC |
review |
review of cmd/corral/ledger.go by claude-code: 1 reproduced, 5 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 94 | 2026-09-08 19:09 UTC |
review |
review of scripts by claude-code: 1 reproduced, 7 code-read, 1 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 93 | 2026-09-08 18:59 UTC |
review |
review of internal/auditpush by claude-code: 3 reproduced, 4 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 92 | 2026-09-08 18:01 UTC |
review |
review of scripts by claude-code: 5 reproduced, 3 code-read, 1 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 91 | 2026-09-08 17:49 UTC |
review |
review of eval by claude-code: 4 reproduced, 4 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 90 | 2026-09-08 17:39 UTC |
review |
review of internal/auditpush by claude-code: 1 reproduced, 3 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 89 | 2026-09-08 16:38 UTC |
review |
review of .github/workflows by claude-code: 1 reproduced, 7 code-read, 1 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 88 | 2026-09-08 16:29 UTC |
review |
review of site/src/content/docs/docs by claude-code: 7 reproduced, 1 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 87 | 2026-09-08 16:18 UTC |
review |
review of internal/auditpush by claude-code: 3 reproduced, 7 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 86 | 2026-09-08 15:41 UTC |
adjudication |
confirmed 618e234b8038#R1 by pdbethke: reproduced by hand: with no secret key, session["a"]=1 and session.update() both raise the documented RuntimeError, but session |= {"a": 1} is silently accepted and the write is dropped — the reviewer script failed on its own fixture, the defect stands · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 85 | 2026-09-08 15:41 UTC |
review |
review of src/flask/sessions.py by claude-code: 0 reproduced, 5 code-read, 0 hypothesis · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 84 | 2026-09-08 15:41 UTC |
scan |
signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 83 | 2026-09-08 14:41 UTC |
scan |
signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 82 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 4d83ed44bab5#R1 by pdbethke: real, reproduced: copyTree does not skip a dependency directory that is tracked in git; the pool copy fails and the run drops to one tree · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 81 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 167dd45b25cc#R6 by pdbethke: real, read: a per-file audit entry cannot say which kind of unmeasured an absent kill rate was · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 80 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 167dd45b25cc#R5 by pdbethke: real, read: Go structs are placed in the canonical statement map, which CanonicalStatement's own doc forbids · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 79 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 167dd45b25cc#R4 by pdbethke: real, read: the statement signs model names but not tool/version or lang; an agentic seat is indistinguishable from an API seat under a cap · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 78 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 167dd45b25cc#R3 by pdbethke: real, reproduced: the attestation strips Coverage; a blanket approval is attested as an ordinary zero-finding review · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 77 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 167dd45b25cc#R2 by pdbethke: real, reproduced: ReproductionsSHA256 omits Unrun, so the harness-failure marker can be added or cleared under a valid statement · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 76 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 167dd45b25cc#R1 by pdbethke: real, reproduced: durationS 0 is signed where no wall clock was measured · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 75 | 2026-09-07 22:27 UTC |
adjudication |
confirmed e00b52bab444#R2 by pdbethke: real, reproduced: migrateTable hardcodes database_name = 'warehouse'; EnsureSchema fails on a plain handle · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 74 | 2026-09-07 22:27 UTC |
adjudication |
confirmed e00b52bab444#R1 by pdbethke: real, reproduced: writeLedgerFile stamps PushedBy on an empty ScanRow, minting a phantom corral_scans row · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 73 | 2026-09-07 22:27 UTC |
adjudication |
confirmed a906b2676dca#R2 by pdbethke: real, reproduced: an object with only an opinion key passes the review-shape check; a stray literal replaces the payload · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 72 | 2026-09-07 22:27 UTC |
adjudication |
confirmed a906b2676dca#R1 by pdbethke: real, reproduced: OutcomeOf credits a REPRODUCED finding as held without requiring an exit code on the record · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 71 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 8377ae6320cc#R7 by pdbethke: real, read: scans show -h never reaches usage; the id is parsed before the flag set exists · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 70 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 8377ae6320cc#R6 by pdbethke: real, read: --attest decides 'signed' by stat-ing the envelope path and discards the signer's error · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 69 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 8377ae6320cc#R5 by pdbethke: real, read: review show prints a retracted review in full and review plan counts it as coverage · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 68 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 8377ae6320cc#R4 by pdbethke: real, reproduced: the CLI reference documents scans push, a verb the dispatcher does not have, with its error as the body · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 67 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 8377ae6320cc#R3 by pdbethke: real, reproduced: corral ui renders a retracted review as live — the retraction has no effect at this door · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 66 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 8377ae6320cc#R2 by pdbethke: real, reproduced: seal --json drops every honesty flag the text table prints as CAVEAT · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 65 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 8377ae6320cc#R1 by pdbethke: real, reproduced: seal --json names the push time 'audited' · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 64 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 9e3f89b00949#R2 by pdbethke: real, reproduced: idSuffix strips punctuation so a/b and a-b collide into duplicate declarations · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|
| 63 | 2026-09-07 22:27 UTC |
adjudication |
confirmed 9e3f89b00949#R1 by pdbethke: real, reproduced: JS/TS collision repair is an unscoped textual replace that rewrites string literals in proven tests · signer name is self-reported: corral-ledger-3 does not cover keyid in the hash, so it is not vouched for by the signature (the signature itself is checked) |
verified
|