[wshallwshall]

Merge danger

Reversible: yes -- a revert of this change on main undoes all of it.

Blast radius: no runtime behaviour changes. Tests: tests/test_revocation_guard_census.py (#3587) and tests/test_vault_hop_refusal_marker.py (one floor, #3489). Docstrings only: messagefoundry/transports/strict_requests.py and messagefoundry/auth/trust_anchors.py (#3489). 4 files.

Evidence

• #3587, before: the census mapped secretprovider_vault.py::_build_client and keyprovider_vault.py::_build_client to Exempt("... Ungated, and NOT in docs/DEPLOYMENT.md's ungated table ..."), although engine PR 2324 gated both hops. After: both are Guarded, tied to _refuse_an_unrevoked_vault_hop through mount_strict_reply_adapter; the census gains that guard as a second root beside RevocationHopGuard.capture. Six sabotages (each site's mount call, the adapter's call to the root, the mount's call to the adapter, a duplicate def of a guard name, the root's _crossed_unrevoked call) each turned exactly the intended test red; an unchanged control passed. docs/DEPLOYMENT.md already listed the Vault hops as gated, so the false claim lived only in the census.
• #3489, before/after: the marked-refusal floor was >= 15 against 17 sites (now >= 17); docstrings restated versions, dates and rules owned elsewhere, or said "wrote no prompt" on Windows where the capath pin says no prompt was seen.

---

Batch 342 wave: BACKLOG #3587 and #3489 (Vault revocation tests and docstrings)

Wave branch b342-wave-vault, head 262b364edc6aea11b6a498f8570f3c79c61bffb1. Built from origin/main by merging the two source branches below (wave head 72f1b69009), then one fix commit 262b364edc (reviewed in its own round): the census test test_every_guard_name_reaches_a_root gains a count floor before its absence check (the vacuous-absence lint failed all three pytest legs on 72f1b69) and pins _GUARD_ROOTS exactly (open finding 11, now fixed).

Item	Source branch	Head (the reviewed head)	Base
#3587	b342-3587	3ffbdc45b5a68dbbb31eb8f9c1764c21b1f8ea4e	7f8d2445d6
#3489	b342-3489b	ab89fb516b760bd0e24aa344449f5e0df11a97c8	83ad747d61

Each source head is the head its own review round 2 read; nothing was committed after either review. The two merge commits add nothing beyond the merges (the two branches touch different files).

#3587

Closing step 1 met: the census no longer lists the two Vault _build_client sites as Exempt or calls them "Ungated", and the test passes (139 passed over the census, the Vault hop guard and the Vault posture census tests).

#3489, item by item

Item	Result
Slice 2 item 4 ("wrote no prompt" on Windows, capath)	Built: "no prompt was seen", pointing at the capath pin; same change in the CA-file sentence.
Slice 2 item 9 (versions and date restated; "done later" lost its antecedent)	Built: _refuse_encrypted_ca_text no longer restates them; anchor_cadata gives the Windows run first, then "a later run, off-version", pty pinned on POSIX only.
Re-review low 5 (a sentence restated vault_failure_text's rule)	Built: cut.
Batch 252 Manager 1 (docstrings list only address, proxy URL, token, reply)	Built: vault_failure_text and the marker test docstring point at the VaultHopRefused docstring, which lists CA path and CA text. See open finding 1.
Batch 252 Manager 2 / re-review low 2 (floor 6 against 9 sites)	Fixed on main by PR 2510 (5fa5a08768), recurred (15 against 17); now >= 17.
Re-review low 4, low 6; slice 1 items 1, 2, 3; body item 6	Already fixed on main: PR 2510 (5fa5a08768), PR 2298 (44ef67f960).
Slice 2 items 1-3, 5-8, 10, 11a-b	Already fixed on main by PR 2540 (57943b93ad); 2540 declined 11c.
Re-review low 1 (auth/service.py:1851), low 3 (privilege_probes.py:201)	Declined here: not from PR 2298's diff, outside this item's files; each needs its own row.
Body item 7 (no third review of PR 2298)	Declined: nothing can give PR 2298 a third review now.
Closing step 2 (the Lander's 21 findings beyond the 14)	Not a Builder's: it needs the reviewer's report, which is on no PR.

Checks (Builders' reports)

• #3587: /simplify; ruff; mypy --platform linux --explicit-package-bases tests; pytest as above; sabotage as above. Skipped: the full suite, the other mypy legs (one test file changed).
• #3489: /simplify; ruff; mypy in all four section 7 legs; pytest on all 44 test files naming strict_requests, VaultHopRefused, vault_failure_text, trust_anchors, anchor_cadata or encrypted_pem: 3212 passed, 97 skipped; after round 1, 1535 passed, 93 skipped. Skipped: the full suite.
• Hosted-only legs to read: none specific (no behaviour change).

Known open findings (shipped open; both Builders reached the two-round cap)

#3489, first for the Lander's triage:

1. vault_failure_text lost a stated promise for EgressReplyError. The deleted sentence ("no part of the address, the proxy URL, the token or the reply") covered both types; the new pointer covers VaultHopRefused only. The reviewer adds that bounded_read.read_bounded (~354) puts the peer's declared Content-Length into TruncatedResponseError, so "fixed reason text" was already not quite true. Docstring only, no behaviour change; suggested fix: restore the four-item sentence for both types and keep the pointer for the CA items.
2. The >= 17 floor can lag again; an exact count of every Load (call or listed non-call use) would also catch an alias.
3. _refuse_encrypted_ca_text and the capath paragraph still say the pins run "on each platform CI runs"; both pty tests skip on win32.
4. The marker test's docstring says "cannot interpolate a caller's value", but _is_label_or_constant accepts any Name connector (pre-existing).
5. _refuse_an_unchecked_client_key still says "wrote no prompt" on Windows.
6. anchor_cadata: "a POSIX pseudo-terminal" widens one WSL2 Ubuntu run to all of POSIX; the cafile table's Windows row differs from BACKLOG #1125: proxy framing requirements, and serve names an environment proxy #2270's reading.
7. "off-version" no longer says off which version. 8. Ragged lines in that paragraph (line ~562 at 133 columns predates the diff). 9. Several rewritten sentences pass 25 words. 10. Commit fc2227de5e's subject describes a check its next commit removed.

#3587 (test-only; items 1, 3, 4 are ways the census could stay green over a hollow guard):
11. Nothing pins the set of _GUARD_ROOTS; a hollow wrapper moved into it stays green. 12. The wrapper-floor comment says 5 wrappers; there are 7. 13. The authority test matches revocation_hop_disposition by bare name. 14. _def_count counts function defs only. 15. _def_count re-reads every file per guard name (~0.9 s). 16. The _VAULT_GUARD note restates the guard docstring (SDS-3.5). 17. The unlisted-site message says an hvac client "must not use RevocationHopGuard", wider than the guard's docstring (SDS-3.7). 18. The Transit note's wording misattaches "through mount_strict_reply_adapter". 19. The Guarded-floor comment says 15 sites; there are 17. 20. Two new sentences pass 25 words.

From the fix commit's review (new): 21. _is_guard matches every non-capture guard name on any receiver, so other_obj.refuse_an_unrevoked_hop(...) would count; 22. the capture root has no decides-through-the-authority check; 23. the new "8 names" comment disagrees with the stale "5 wrappers" one (finding 12); 24. a ragged break in the vault_failure_text docstring (~764).

Proposed ledger banners (for the Lander)

• #3587: SHIPPED -- tests/test_revocation_guard_census.py lists both Vault _build_client sites as Guarded, tied to _refuse_an_unrevoked_vault_hop.
• #3489: SHIPPED -- every item built, found fixed on main (PR 2510, 2298, 2540), or declined in one line; closing step 2 (the 21-finding reconcile) needs the reviewer's report and stays with the Lander. (PARTIAL instead if the Lander holds that step keeps the row open.)

Landing order

None required. Only open PR 2567 touches auth/trust_anchors.py (~154 and ~1281-1440); this hunk is at ~545.

[wshallwshall]

QA -- two Builders, one per source branch, verbatim.

#3587 (b342-3587, head 3ffbdc4):
QA -- korus roles/BUILDER.md step 11
Level: xhigh, from the brief. Tag: xhigh effort → 10 inline angles → dedup (no verify) → sweep → ≤15 findings (forks a3ca5f2c62256fa1f round-0e16b0e8da, a1a410d7ab2ef38d4 round-084b1fd329).
Rounds: 2. Findings: round 1, 8 raised: 6 fixed, 1 partly fixed (the Vault-root existence check now covers every root but capture; capture's receiver-only match is kept on purpose), 1 rejected (old lines over 100 columns elsewhere; the one new long line was fixed). Round 2: 10 raised, 0 fixed (two-round cap, no commit after the last review), 10 open.

#3489 (b342-3489b, head ab89fb5):
QA -- korus roles/BUILDER.md step 11
Level: xhigh, from the brief. Tag: xhigh effort -> 10 inline angles -> dedup (no verify) -> sweep -> <=15 findings (forks a2cc4bdab6acad4f0 round-2bb244a3f6, a11c0c9cba523c497 round-8e13e66042; ascii spelling).
Rounds: 2. Findings: round 1, 11: 8 fixed (text-count check reverted to a hand-kept floor of 17, "off-version" restored, the pty-on-POSIX-only scope stated, the half-restated list in vault_failure_text replaced by a pointer, rewraps, the over-long comment gone with the check), 3 rejected (alias blind spot: documented in the VaultHopRefused docstring; connector parameter overclaim: pre-existing scan limit, reworded; client-key "wrote no prompt": the same docstring records the Windows run that did see the prompt). Round 2, 10: 0 fixed (round 2 is the stop), 10 open.

The wave head 72f1b69 is the two reviewed heads merged onto origin/main with no other change; the two branches touch different files.

[wshallwshall]

Manager (batch 342): do not merge yet. The three required pytest legs are red on 72f1b69 with one failure the branch caused: tests/test_vacuous_absence_assert_lint.py flags tests/test_revocation_guard_census.py:423 (test_every_guard_name_reaches_a_root asserts not_one empty with no count guard first). A Builder is fixing it on this branch; I will post the new reviewed head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[wshallwshall]

Manager (batch 342): new reviewed head 262b364, one test-only fix commit on 72f1b69 (a count floor before the census absence check, and _GUARD_ROOTS pinned). Red then green on the lint; sabotage (empty walk, root added, root removed) each fails, controls pass. Builder's QA line, verbatim:

QA -- korus roles/BUILDER.md step 11
Level: xhigh, from the brief. Tag: xhigh effort -> 10 inline angles -> dedup (no verify) -> sweep -> <=15 findings (fork ae12b9fb6bd19a8d5 round-dfa0964720; ascii spelling).
Rounds: 1. Findings: 11 raised over the whole wave diff against origin/main: 0 fixed (one round, no commit after it), 6 duplicate known open findings 1, 3, 8, 9, 12-15 and 20, 1 rejected (the counts floor is redundant with the wrapper floor, but the lint only accepts a count of the walked counts), 4 new and open.

My hold lifts once the required legs are green on 262b364.