knowledge: 12 insights — deny rules under bypass, merged-tree gate, worker verify command, Kotlin daemon heap, extracted-method this (+7 merges) - #179
Conversation
5 new pages, 7 amended pages, 5 domain indexes + root INDEX updated. New: platforms/tools/deny-rules-under-bypassed-permissions, infrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge, infrastructure/agent-orchestration/verify-command-in-a-worker-brief, backend/java/kotlin/compiler-daemon-heap-pressure, testing/mocking/extracted-method-this-binding. Amended: unicode-text-matching, worktree-isolated-workers, spec-document-gates, path-valued-config, completion-claims, shared-run-state, test-data-and-isolation. See .dev-loop/INGEST_REPORT.md for sources, dedup and routing.
choiyounggi
added
the
dev-loop:knowledge
…kers (pre-write escape deny + --git-common-dir mechanism)
|
Folded one candidate from the 2026-09-03 18:46 flush (PR #180) into this branch instead of opening a sibling edit: |
Wiki agent gate: failPR #179 touches wiki/** (5 new pages, 7 merges, index/log updates). Transferability check: clean — all five new pages teach a general, externally-verifiable directive; private-repo field evidence (linkly, dev-loop, groundwork, rtb-unified-style names) is used only as evidence, not as the directive's subject, and "groundwork" is elsewhere noted in this wiki as a public repository. Duplication check: clean — an independent search of the existing wiki (via subagent, cross-checked by me) found no directive that is a full pre-existing duplicate; the two cases with partial conceptual overlap (deny-rules-under-bypassed-permissions vs. agent-permission-classifier-denials; verify-command-in-a-worker-brief vs. path-resolution/version-management) are already cross-linked both ways via
|
…to worktree-isolated-workers
|
Fold from the 2026-09-03 20:38 flush (queue hash |
…-routed edits into worktree-isolated-workers
|
Folded two queued candidates from flush run 20260903-213946-4161 into this branch (commit e242b2c) instead of opening a sibling PR:
Index load-when cell for verify-command updated; log.md appended; wiki-structure-checks and wiki-lint-prohibitions both clean on the branch. |
…d stale install/codegen re-sync into worktree-isolated-workers + semantic-conflicts-after-parallel-merge
|
Fold from flush
Lint on this branch: structure 0 findings, prohibitions 0 violations. |
1 participant
Knowledge flush — 12 insight(s)
Batch: 12 of 109 pending candidates were claimed (
queue-claim.js claim --max 12) so the PR stays reviewable; the remaining 97 stay pending for later flushes. Every claimed row was handled (none released): 5 new pages, 7 merges into existing pages, 0 dropped. Each claim was researched by a dedicated verifier agent against live-fetched primary sources and, where possible, reproduced locally; two candidate details were found wrong and corrected in the pages (noted below).Verified best-practice
2002a817b2e74f84LC_ALL=C; group it(─){3,}and test under C─{3,}→ 0 under C, 1 under UTF-8;(─){3,}→ 1 in both; a─+ two bare0x80bytes matches─{3,}under C (last-byte binding). GNU grep not installed → GNU result stated as untested6b8811c6c3b0f983permissions.denyis enforced inbypassPermissions; deny wins at every level; compound commands split per subcommand; wrappers strippedenvamong stripped wrappers; the docs' list istimeout, time, nice, nohup, stdbuf, command, builtin, noglobplus a leadingVAR=value—envis not stripped. Page says soa9ebd8fda72aade6Exception during IR lowering→ suspect heap; raise Gradle + Kotlin daemon heap at user levelkotlin.daemon.jvmargsvs-Dkotlin.daemon.jvm.options, inheritance); https://kotlinlang.org/docs/kotlin-daemon.html (inherits-Xmx)kotlin.daemon.jvm.options=-Xmx4gline is a system property valid only insideorg.gradle.jvmargs; the Gradle key iskotlin.daemon.jvmargs. The symptom→heap link has no external source (documented causes of that message are compiler bugs), only the session's one measured build (19 min fail at 1g → 4m13s pass at 4g)44cd212b53946b62git status, transfer by patch (diff→apply --check/apply→checkout --)Edit|Write, exit-2 block); https://git-scm.com/docs/git-worktree; https://git-scm.com/docs/git-apply (--checkquote)MAIN_CLEAN). Merged into a page alreadyverified2e3d108012a7e164this; bind at extraction; avi.fn()test cannot catch itnode -erepro: unbound →TypeError: Cannot read properties of undefined; bound → 42. Correction: Vitest'smock.contextsrecordsthisper call, so avi.fn()test can catch it when it assertsmock.contexts[0] === obj; page offers that as the third test shape28897d4a24a46ae9f978fd126f72956fRan N / failures=MfirstRan 3 tests … FAILED (failures=1, errors=1)reproduced locally; field measurement 3532/15+18 vs 3549/1076309143096ed63missing: ['grammar'])5d4a63ae21e06d9echeckout -- <path>discards unstaged changes); https://pitest.org/quickstart/basic_concepts/; repo's ownagents/test-quality-auditor.md(restore mechanism)d3d8fdcc202b8760tmux lssees one server only; before resuming as coordinator, prove no live coordinator viaps+ artifact mtimesman tmux(list-sessions scoped to a server;-L/-S);man ps(-A,-o lstart,command); reposkills/orchestrate/SKILL.mdre-entry section87d2a59d6b82953crequired=Trueaccepts"";realpath("")is the CWD; reject empty before resolvingparse_args(["--out",""])→Namespace(out=''),realpath('')→ cwdf301809d865f8865bats-run-*naming); reposkills/orchestrate/scripts/{escalation-dir,worker-guardrails,watch-status}.sh; guard sourcegroundwork/plugins/guardrails/hooks/bash-guard.sh+ its bats tests (the two named tests do notcdinto their tmpdir)Existing-layer check
Routing went through
INDEX.md, then the domain indexes for infrastructure, backend (+ java, python, node subtrees), frontend, testing, platforms, qa, debugging, and the security agent-exposure section; every page whose "load when" overlapped a candidate was opened in full.Pages read: platforms-environment-unicode-text-matching, platforms-shells-escapes-in-shell-string-literals, platforms-environment-timezone-and-locale, platforms-tools-agent-permission-classifier-denials, infrastructure-agent-orchestration-worktree-isolated-workers, qa-process-scope-purity-checks, backend-java-runtime-threads-and-memory, testing-mocking-what-to-mock, testing-quality-tests-that-cannot-fail, infrastructure-agent-orchestration-shared-run-state, backend-common-change-impact-cross-module-consumer-census, infrastructure-agent-orchestration-autonomous-decision-rulings, platforms-environment-path-resolution, platforms-toolchains-version-management, qa-process-completion-claims, testing-quality-spec-artifact-checks, qa-document-verification-spec-document-gates, testing-quality-checks-that-cannot-pass, testing-quality-harness-reverse-controls, testing-quality-mutation-harness-file-custody, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-config-path-valued-config, backend-python-boundaries-runtime-validation, testing-data-test-data-and-isolation, testing-data-artifact-leakage-from-a-suite
Per candidate:
unicode-text-matchingalready has a generic "quantifier over non-ASCII → test on both userlands" rowrelated+bsd-vs-gnu-cli both waysagent-permission-classifier-denialshas the deny tier in its precedence table but is scoped to auto-mode classifier denials;worktree-isolated-workerscovers path isolation, not command classesplatforms/tools/deny-rules-under-bypassed-permissions; links both ways with classifier-denials, worktree-isolated-workers, control-signals, binding-instructions, checks-that-cannot-passthreads-and-memorycovers runtime heap diagnosis, not the build daemons; no Gradle/Kotlin-compiler page existsbackend/java/kotlin/compiler-daemon-heap-pressure; links both ways with threads-and-memory, reading-error-messages, hypothesis-testingworktree-isolated-workersalready carries the Bash-hook-vs-Edit/Write edge row and Instead-of rowwhat-to-mockandtests-that-cannot-failcover mock-hides-bug generally; nothing onthisbindingtesting/mocking/extracted-method-this-binding; links both ways with what-to-mock, tests-that-cannot-fail, captured-call-arguments, test-level-choiceshared-run-state(default branch moved),cross-module-consumer-census(integration-time census),widening-a-closed-value-table(enum/table widening) are adjacent; none covers the post-merge build gateinfrastructure/agent-orchestration/semantic-conflicts-after-parallel-merge; links both ways with those three, autonomous-decision-rulings, worktree-isolated-workers, completion-claimspath-resolution(pin binaries in automation),version-management(shims absent non-interactively),completion-claims(dropped total = red) each hold one thirdinfrastructure/agent-orchestration/verify-command-in-a-worker-briefcomposing them for the brief-authoring trigger; links both ways with all three, compiler-sysroot-on-macos, tests-that-cannot-fail, worktree-isolated-workersspec-document-gatesaxis table ("token survives in a nearby paragraph"),spec-artifact-checks(negative control per check),checks-that-cannot-pass(known-good/known-bad) already own the principlespec-document-gates: +1 edge row (heading-scoped word-boundary match + pre-fix revision as negative control), +1 Instead-of row, +2 sources. Near-duplicate; the heading/word-boundary scoping and revision-as-mutant detail were the only additionstests-that-cannot-fail(restore mechanism by commit state; multi-agent shared tree),mutation-harness-file-custody(untracked file diffs clean either way),completion-claims(relaying subagent reports)completion-claimsclaim/evidence table (+1 row, +git-checkout source, +field reproduction);related+mutation-harness-file-custody both ways. Not added to tests-that-cannot-fail (115 body lines, near the cap)shared-run-statestep 3 confirms a foreign run from the repo;autonomous-decision-rulingsstep 3 re-reads the ledger on resumeshared-run-state: +1 edge row (coordinator liveness on resume: tmux-server scope,ps, artifact mtimes, both-absences rule), +1 Instead-of row, +man ps citation, +field reproductionpath-valued-configalready rejects non-absolute paths (an empty string is non-absolute) and lists rejection test inputs""added to the rejection test set, +1 edge row (argparse presence-only, realpath("") = CWD), +1 Instead-of row, +3 sourcestest-data-and-isolationalready has two rows on harness-injected env vars and "the code under test is the harness that spawned the session" (issue #100, same shape)shared-run-stateConflicts flagged: none — every merge extends an existing directive; no existing directive was contradicted or overwritten.
Open-PR check
returned no rows, and
gh pr list --state open --limit 50(any head) also returned no rows at flush time (2026-09-03 17:28 KST, aschoiyounggi). No sibling knowledge branch exists, so no candidate could fold into or duplicate an in-flight PR.Per-candidate verdict: all 12 → new (no overlapping open head).
Routing decision
toolsalready holds Claude Code harness pages (classifier denials, plugin MCP registration, version-keyed cache); no new categorykotlinis the Kotlin-only subtree category; the Kotlin compile daemon is Kotlin-only; no new categorymocking; frontend has no language-mechanics category and the lesson is not React-specificagent-orchestrationagent-orchestration(same category as worktree-isolated-workers' brief rules)No new category was needed. Indexes updated:
wiki/platforms/index.md,wiki/infrastructure/index.md,wiki/backend/java/index.md,wiki/testing/index.md,wiki/qa/index.md, rootINDEX.md(infrastructure and platforms route lines);log.mdappended.Checks run before the PR:
node scripts/wiki-lint-prohibitions.js wiki,node scripts/wiki-structure-checks.js wiki, body-line counts of every touched page (≤120), and a resolver over everyrelated:id, inline[id]reference, and page-to-index listing (results in the PR conversation).