Case 02 of 03 · Local repair account

Why the validation check missed an unchanged file

My validation check looked only at edited files, but expected evidence from an unchanged file too. The repair was to check the full set of files that would be committed.

Start with the missing file

A check expects two reviewed markers: one in an edited file and one in an unchanged file. Scanning only the edited file finds one. The review list is correct; the scan covers the wrong set of files.

Synthetic illustration · Python standard library

python3 unchanged-file-demo.py
changed-only: 1 of 2 reviewed markers found
full snapshot: 2 of 2 reviewed markers found

Download the runnable example. Save it locally and run the command above with Python 3. It uses two in-memory file entries, performs assertions, and writes no files.

This tiny example illustrates coverage only. It is not the original guard, a secret detector or proof of a secure workflow.

Follow the repair

The local check initially identified reviewed findings by line offsets. Ordinary edits could move the lines. The repair matched each finding using its path, rule and content hash, and required a unique match.

A second problem appeared during staged validation: the changed-only scan expected six reviewed findings, including findings in two unchanged files. Scanning the complete prospective index—the full file snapshot that would be committed—restored the intended coverage.

The next attempt exposed a different defect. A newly added synthetic fixture contained an email-shaped literal that the author and reviewer had missed. The content gate blocked it. Replacing it with an innocuous, non-email fixture fixed that defect without disabling the gate.

When a check stops you

Native approval rejection: retain the rejection; do not retry the same action through another route.
Filesystem restriction: use the supported permission mechanism for an already-authorized path.
Content or hook failure: diagnose and repair the failing content within the approved scope, then run the relevant checks.
Missing action authority: stop at the boundary and obtain the required authorization.

First identify what stopped the work. A content failure calls for a repair; passing that check still does not give permission to commit or publish. Explicit no-retry instructions and other action limits still apply.

What this example shows

Source: author-reported local repair summary. The underlying local receipts are not published here and are no longer available at their former temporary location. This page does not offer independently reproducible verification of that historical work.

58 synthetic fixture tests passed before a small amendment; 8 focused tests were rerun after it.
The complete preflight covered 27 blobs: 6 reviewed findings and 0 unresolved findings.
The eventual normal local commit contained 13 files. Its hook passed; Gitleaks reported no leaks and TruffleHog reported 0 secrets.
The local repair received independent acceptance, according to the same author-reported account.

The fresh downloadable illustration is separately checkable. It demonstrates why a changed-only scan cannot find a marker in an unchanged file. It does not reproduce the historical test counts, validate the private controls, or establish that no sensitive material could ever pass.

Use the lesson

Make the check's expected coverage explicit. If it judges a complete candidate snapshot, test that snapshot—including unchanged files that supply required evidence. Keep the evidence for correctness separate from permission for the next action.