story-031: A mutation control mutates the working tree, never a pinned revision

[jerodw]

story-029 retired the practice of recovering an older story_coordinator.py out of git history and running it, and enforced the retirement with two scans. One call site survived both and reproduced the decay one story later, inside story-029's own validation file: a mutation control that pinned the coordinator's source at a commit, wrote it into a copied repository and ran a test against it. When story-028 reshaped on_failure and clean_clone, the pinned coordinator could no longer run against the workflow it was paired with, so every case failed its control rather than its subject.

story-028 repaired that call site in passing. This story states the rule it implies and enforces it.

What changed

A fourth rule joins the three in tests/test_baseline_honesty.py. mutation_controls(source, module) returns the same Flag records the others do, and reports a pairing: a revision-bounded read that flows into a write to a path, in a function that also executes source. Each half alone is legitimate and stays unreported — a bounded read that is only compared is what establishing a story's diff looks like, and mutating the working tree is what a control is supposed to do.

The rule is narrower than "never pin a revision", deliberately. story_diff, repository_file_at and function_source_at exist to read pinned revisions and are untouched. The rule is about mutation controls specifically: the property being demonstrated — this assertion goes red when what it names is violated — belongs to the assertion and the code it is about, both present in the working tree. Pinning the subject adds a variable that can only make the control fail for reasons unrelated to what it demonstrates.

No module is exempt, and the absence is argued rather than overlooked. The two story-029 rules exempt conftest.py because it is the one place the thing they forbid is correct. A mutation of pinned source has no such place: load_mutant takes a working-tree path precisely so pinned text is not a value it accepts.

Note for review

The scan's first implementation had a false positive the verifier caught and rejected the attempt for: a spawned git show is a subprocess call, so a git-form bounded read supplied its own execution half — the same benign shape was reported or not depending on how the bound was spelled. _executing_functions now skips any call that is itself a revision-bounded read. ARCHITECTURE.md records this.

Verification

• 1636 passed, verification passed, clean-clone green with the story committed
• One retry, routed to implementation by the verifier's category — the false positive above
• The scan is asserted to report the one known real instance: story-029's control as it stood before story-028 repaired it

History

This branch carries two escalation commits. The first attempt assigned tests/test_baseline_honesty.py to the implementer with no grant lifting its tests/ restriction — the planner defect story-032 now refuses at plan time. The second escalated on a stale implementation-summary.md after the retry, which is the case self-routing-retries is open to convert into a self-route. Both are kept rather than squashed, so the record matches what happened.

🤖 Generated with Claude Code