Read log v7: read Glob/Grep patterns as the glob engines do, and deny every removed file

[MaxGhenis]

Status: ready for review. Head b3151f4c is 3e07974d with master (ed542625) merged in.

• Review rounds 1-5: GPT-6.1 Sol requested changes in each. Every finding is addressed below.
• Round 6: APPROVED 9eb88820, served by gpt-6.1-sol. Its one low finding (say that an unclosed !( is refused too) is fixed in 3e07974d, with wording and assertions only.
• Round 7: a confirmation of that diff is running as Subfleet job 20261015-234404-readlog-v7-534-r7.
• Merge slot: from the coordinator, after d1408: delayed-credit erratum diagnostic (counts and changes only) #538 and Describe the apply gate's exception handling as main's core does #543.

Follow-up to Q6 round 10's two tooling items on the B0.1 review read log (scripts/track_b_b0_1_review_root.py). It also makes the section 15 wording fix that #505's merge-gate review asked for.

What changes

pattern_kind, read-log schema track_b_b0_1_review_read_log.v7.

v6 cut every pattern at /, braces and commas, even inside [...], and read the pieces with Python's fnmatchcase. Round 10 showed that stem[.,]md, stem[!,]md and stem[{.]md slipped through.

Probing three engines on invented files, and then the Sol review of this PR, found many more forms that they resolve to the file:

• ripgrep 15.2.0;
• Node 26.8.2 fs.globSync, which builds a Minimatch with nocase on macOS and windowsPathsNoEscape, read from Node's internal/fs/glob;
• Bun 1.3.12 Bun.Glob.

v7 reads a pattern every way these engines might:

1. Brace readings.

   • As bash and Node read braces, with and without sequences ({m..m}).
   • As ripgrep and Bun read them: a comma or brace inside a class or after a backslash is not syntax, and a comma-less group stands for its content. This runs both with a backslash inside a class escaping, as Bun reads it, and without, as ripgrep reads it.
   • Each result again with backslashes as /, as Node reads them.

2. Extglobs. Each is read once by the one-occurrence text expansion, and exactly by the automaton below.

3. Two readings of each text.

   • v6's fnmatchcase cut, plus round 10's smallest fix (the whole-stem test on /-segments).
   • A token reader: classes, escapes, POSIX classes (ascii included; an unknown name stands for any printable character), !/^ negation, one-character classes and extglob groups are read as the engines read them. In Bun's reading, [\d] is d alone. Segments are cut only outside classes, and a class that may stand for / both cuts and does not. This reader runs with and without class escapes, and again with case folded.

4. The test. A segment names a denied file if:

   • its literal view equals the name, or starts with the stem and a dot; or
   • it holds the whole stem and matches; or
   • pins_stem: on an exact Thompson automaton of the segment, it matches the name and reads no other character at any position of the stem, case aside. A class's / is not another character, since a file name holds none. This catches stems spelled by syntax, such as [d]eep, d+(e)p, deep_den{i..i}ed, [\d]eep (Bun) and [d/]eep (ripgrep).

5. Unclassified. These patterns are unclassified, which voids the review:

   • longer than 1,024 characters (PATTERN_LIMIT);
   • more than 4,096 readings, or 4,096 segments in one reading;
   • readings whose squared lengths sum past 2**24 (WORK_LIMIT);
   • an automaton past 100,000 closure entries (CLOSURE_LIMIT);
   • nested too deep to read;
   • a sequence number too long for int().

   class_end and _extglob_group are memoized. The worst case at the length limit is about 0.16 s of CPU.

Disclosed limits.

• !(...) reads as *, so an exclusion filter naming a denied name voids the review. This is conservative (round 1's low L1).
• A wildcard, a negated class, or a class of two or more characters other than one letter's two cases, standing at a stem position, is not classified: ?ates.yaml, [gx]ates.yaml, *name_part*.
• Brace and extglob alternatives that include the right letters do name the file (g{a,x}tes.yaml, g*(a|x)tes.yaml), as since round 8.

Engine evidence (1 means the engine found docs/sub/deep_denied.md; v6 classed all of these inside_root):

Pattern	rg	Node	Bun	v7
**/deep_denied[.,]md, [!,], [{.], [^,]	1	1	1	denied
**/deep_{denied[.,]md,x}, {denied}, {.}, {{i}}	1	0	1	denied
**/deep_denied\.md	1	0	0	denied
**/deep_@(denied).md, +(denied), [[:punct:]]	0	1	0	denied
**/deep_denied[/.]md; docs/sub[!x]deep_denied.md	1	0	0	denied
**/[d]eep_denied.md	1	1	1	denied
docs/sub/DEEP_DENIED.MD; **/Deep_Denied.m? (Node)	0	1	1/0	denied
round 1: **/deep_denied+([.m])d, *([.m])d	0	1	0	denied
round 1: **/deep_denied[.,]{m..m}d	0	1	0	denied
round 1: **/deep_denied[.\]]md	0	0	1	denied
round 1: **/deep_denied[[:ascii:]]md	0	1	0	denied
round 1: docs\sub\deep_denied.md	0	1	0	denied
**/d+(e)p_denied.md	0	1	0	denied
**/deep_{denied[.\]m,zz]}{d}	1	0	0	denied
**/deep_d{enied[.\],]md}	0	0	1	denied
round 2: **/[\d]eep_denied.md	0	0	1	denied
**/[d/]eep_denied.md	1	0	0	denied
**/*, **/*deep*, ?ates.yaml, [gx]ates.yaml	n/a	n/a	n/a	inside_root

Round 1's 50 candidates were all rerun, and the 38 that an engine resolves to the denied file are now denied. Round 2's 520 were rerun too, and all 184 that an engine resolves to the denied file with the stem pinned are now denied.

Changes after round 3 (rounds 4-6)

• Negative extglobs: a pattern holding !( outside a class or escape that names no denied path is unclassified, whether or not the group closes. !(|[!d]|??*) spells d in Node. A literal !( is written ![(].
• Plain parentheses: a plain ( inside an extglob is literal, as minimatch reads it; only an extglob opener nests.
• Classes:
  • CLASS_LIMIT (1,024) bounds each range, and then the class after the union, so overlapping ranges are counted once.
  • A chained range ([a-c-e], which ripgrep reads unlike Node and Bun) is unclassified.
  • A class's / or NUL is no other character at a stem position, since no file name holds either.
• Work: the work budget (WORK_LIMIT, 2**22 steps) is charged during expansion, tokenizing and the automaton, and class unions are charged too. The memo tables are cleared after each call.

Denied set.

• New denied_from_record returns denied_paths ∪ removed ∪ removed_codebook_tables. The CLI uses it for both formats.
• read_log compares paths case-folded and records n_denied: 31 for rounds 5-10, being 27 removed files and 4 code-map tables.

Read logs. Rounds 5-10 were regenerated from the review transcripts and the review roots' records, which are byte-identical to the committed ones.

• The v6 tool reproduces all six committed v6 logs byte for byte.
• v7 changes only schema and adds n_denied.
• Round 5 stays void, on the same pattern. Rounds 6-10 still count.
• The revision after round 1 regenerates them byte-identical again.
• The codex logs of rounds 2-4 are unchanged.

Addendum section 15. Section 16 is untouched, and the protocol-hash test passes.

• One read-log sentence describes the v7 rule.
• "The rule as it now stands" now names v7, and the regenerated rounds are now 5-10.
• Round 10's record notes its log was regenerated as v7.
• Round 10's two tooling dispositions say this PR fixes them. The observation row separates the six codebook files from the four code-map tables, as review_r10.md lines 28-31 do (Track B B0.1 addendum: freeze B2's record after the d693-d1342 rulings #505's merge-gate ask).
• One sentence records that this PR changed section 15 after Track B B0.1 addendum: freeze B2's record after the d693-d1342 rulings #505's merge.
• test_track_b_b0_1_addendum_record.py pins all of this.

Invariants (stated and executed)

1. No weaker than v6. A Hypothesis differential against a frozen copy of v6. It also holds by construction.
2. No weaker than round 10's smallest fix. A differential, with an explicit example only that fix catches.
3. Engine soundness on spellings. Any pattern that spells a denied name with syntax alone (no wildcard at a stem position) and that ripgrep, Node or Bun resolves to the denied file is flagged.
   • Committed differential: 1,000 draws (824 distinct patterns). ripgrep resolved 194 to the file, Node 255 and Bun 122, none missed. It skips an engine that is absent.
   • One-off fuzz: 5,154 patterns with up to six stacked changes. ripgrep resolved 916 to the file, Node 1,005 and Bun 540, none missed.
4. pins_stem is the brute-force rule. It agrees with "matches, and no one-position stem change other than case matches" over an alphabet plus a sentinel.
5. The automaton is exact. It agrees with Python regular expressions on extglob pieces (repetition included) and with fnmatchcase on shared syntax.
6. The requested property. Replace a denied basename's extension characters with classes holding the true character plus any of ,{}, or with negated classes of those: the pattern is still denied.
7. Spellings. Case changes, escapes, comma-less brace groups and extglob wraps of any denied name (codebook files and code-map tables included) are denied, or outside_root where Node reads a leading backslash as /.
8. No false positives on unrelated patterns. A pattern with none of the denied names' letters and no dot is never denied.

Mutation check: 60 mutants, all killed

Each mutant is a single edit to the script, run in a scratch copy against tests/test_track_b_b0_1_review_root.py. All 60 are killed at 9eb88820. The runner and results are in the review folder: mutants_runner7.py and mutants-r7.json.

Mutant	First test that fails
class-tokens: glob_tokens reads [ as literal	test_read_log_v7_cases[Glob-**/deep_denied[[:punct:]]md-False]
class-scan: braces and extglobs split inside classes	test_read_log_v7_cases[Glob-**/deep_d{enied[.\\],]md}-False]
comma-less: a group without a comma stays literal to ripgrep/Bun	test_read_log_v7_cases[Glob-**/deep_{denied}.md-False]
escape-tokens: backslash read literally	test_read_log_v7_cases[Glob-**/deep_denied\\.md-False]
escape-scan: an escaped brace is brace syntax	test_glob_readings_follow_the_engines
fold-reading: no case-folded reading	test_read_log_v7_cases[Glob-docs/sub/DEEP_DENIED.MD-False]
fold-path: Read paths compared with case	test_read_log_v7_cases[Read-GATES.YAML-False]
extglob: extglobs not resolved	`test_read_log_v7_cases[Glob-g*(a
posix: POSIX classes read as their characters	test_read_log_v7_cases[Glob-**/deep_denied[[:punct:]]md-False]
caret: [^...] not negated	test_read_log_v7_cases[Glob-**/deep_denied[^,]md-False]
one-member: [c] not read as c	test_glob_readings_follow_the_engines
removed: codebook files not denied by their own names	test_read_log_v7_cases[Glob-**/deep_denied[[:punct:]]md-False]
tables: code-map tables not denied	test_read_log_v7_cases[Glob-**/deep_denied[[:punct:]]md-False]
cli: the CLI passes denied_paths only	test_readlog_cli_denies_every_file_the_root_record_removed
maybe-slash: a class that may be / never cuts	test_read_log_v7_cases[Glob-[a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/]deep_denied.md-False]
maybe-slash: a class that may be / always cuts	test_read_log_v7_cases[Glob-**/deep_denied[[:punct:]]md-False]
notset: a negated class never stands for /	test_read_log_v7_cases[Grep-docs/sub[!x]deep_denied.md-False]
slash-split: round 10's smallest fix dropped	test_v7_catches_what_round_10_s_smallest_fix_would
v6-cut: v6's cut narrowed to slashes	test_v7_voids_whatever_v6_voided
fnmatch-reading: v6 rule and smallest fix both dropped	test_v7_voids_whatever_v6_voided
glob-braces: the ripgrep/Bun brace reading dropped	test_read_log_v7_cases[Glob-**/deep_{denied[.\\]m,zz]}{d}-False]
schema: stays v6	test_read_log_v7_cases[Glob-**/deep_denied[[:punct:]]md-False]
class-end: ] right after [ closes the class	test_glob_readings_follow_the_engines
class-end: a POSIX class is not one member	test_read_log_v7_cases[Glob-**/deep_denied[[:punct:]]md-False]
range: a-z read as its two ends	test_class_unions_are_charged_to_the_work_budget
sequence: a group that is a sequence stays literal	test_read_log_v7_cases[Glob-**/deep_denied[.,]{m..m}d-False]
sequence-reading: bash/Node sequence reading dropped	test_read_log_v7_cases[Glob-**/deep_denied[.,]{m..m}d-False]
bun-class: a backslash in a class never escapes	test_read_log_v7_cases[Glob-**/deep_denied[.\\]]md-False]
bun-braces: Bun's escaped-class brace reading dropped	test_read_log_v7_cases[Glob-**/deep_d{enied[.\\],]md}-False]
bun-tokens: tokens read only without class escapes	test_read_log_v7_cases[Glob-**/deep_denied[.\\]]md-False]
backslash: Node's backslash-separator reading dropped	test_read_log_v7_cases[Glob-docs\\sub\\deep_denied.md-False]
ascii: POSIX ascii missing	test_class_unions_are_charged_to_the_work_budget
posix-unknown: an unknown POSIX class read as its letters	test_glob_readings_follow_the_engines
extglob-tokens: no extglob group token	test_read_log_v7_cases[Glob-**/deep_denied+([.m])d-False]
plus: +(...) may read nothing	test_the_automaton_matches_as_a_regular_expression
repeat: +(...) and *(...) read once	test_read_log_v7_cases[Glob-**/deep_denied+([.m])d-False]
pins-negated: a negated class pins a position	test_a_negation_is_unclassified_unless_it_names_a_denied_path
pins-test: the pin test never runs	test_read_log_v7_cases[Glob-**/d+(e)p_denied.md-False]
pins-case: case counts at a stem position	test_pins_stem_is_the_brute_force_rule
recursion: RecursionError escapes	test_each_work_limit_holds_below_the_length_limit
finishing: only the match state finishes	test_pins_stem_is_the_brute_force_rule
bun-backslash: Bun's class keeps a backslash member	test_glob_readings_follow_the_engines
sequence-number: a number too long to read crashes	test_each_work_limit_holds_below_the_length_limit
closure-budget: the automaton has no budget	test_each_work_limit_holds_below_the_length_limit
padding: padded sequences read plain	test_glob_readings_follow_the_engines
slash-member: a class's / counts as another character	test_read_log_v7_cases[Glob-**/[d/]eep_denied.md-False]
pattern-limit: no length limit	test_patterns_too_large_to_read_are_unclassified[xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx]
segment-limit: no segment budget	test_patterns_too_large_to_read_are_unclassified[[a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/][a/]deep_denied.md]
work-limit: no work budget is set	test_patterns_too_large_to_read_are_unclassified[{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}deep_denied.md]
nul: a class's NUL counts as another character	test_read_log_v7_cases[Glob-**/[d\x00]eep_denied.md-False]
range-bound: a range of any width is built	test_a_wide_range_is_refused_before_it_is_built
memo: the memo tables are kept after a call	test_each_work_limit_holds_below_the_length_limit
segment-count: invalid pairs are counted	test_limits_refuse_only_past_their_bounds
negation: a negated pattern that names nothing is inside_root	`test_read_log_v7_cases[Glob-**/!(
overlap: ranges are counted with their overlap	test_ranges_are_bounded_one_by_one_and_counted_after_the_union
class-members: members past the limit are kept	test_ranges_are_bounded_one_by_one_and_counted_after_the_union
range-union: a union of ranges past the limit is kept	test_limits_refuse_only_past_their_bounds
paren: every ( nests in an extglob	`test_read_log_v7_cases[Glob-**/@([d]
negation-text: only parsed negations count	test_a_negation_is_unclassified_unless_it_names_a_denied_path
chain: a chained range is read as Node reads it	test_read_log_v7_cases[Glob-**/[d-d-d]eep_denied.md-False]

Tier counts (by collection, merged tree)

Unit is 9,796: master's 9,697 at ed542625 plus this PR's 99, which are 82 review-root tests and 17 record pins. The other tiers are unchanged, and the total is 16,287. I will recount against master when the slot comes.

Not determined here

• Which engine the lanes' Glob and Grep tools use. v7 is conservative across all three engines probed. It is a detector over the syntax those engines document, not a proof against every possible engine.
• The codex reader's rule is unchanged. It voids reads, not names.

axiom: n/a: review tooling and its record only (no policy encoding)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
social-security-model	Ready	Preview	Oct 16, 2026 3:49am UTC

[MaxGhenis]

Merge audit for #534 (read log v7).

Reviews. All rounds ran on GPT-6.1 Sol through Subfleet (--task review --tier hard). Each round's prompt, report and evidence are in ~/PolicyEngine/_trackb-reviews/readlog-v7-534-20261012/.

Round	Head	Verdict	Findings
1	bd21ae23	Request changes	5 medium, 2 low
2	7aca400c	Request changes	1 medium, 3 low
3	88142625	Request changes	1 medium, 4 low
4	90eb7bdf	Request changes	1 medium, 2 low
5	fb3c17ee	Request changes	2 medium, 1 low
6	9eb88820	Approve	1 low (wording)
7	3e07974d	Approve	none

Round 7 confirmed the round-6 wording fix; that commit changes no code.

Two review attempts never reached a verdict:

• The first round-3 attempt was stopped by the provider's content filter.
• One round-6 attempt fell to Opus 5.5 while the Codex lanes were exhausted, and was refused there.

Both were re-run on Sol with neutral wording.

Merged head. b3151f4c is 3e07974d with master ed542625 merged in. Master changed none of this PR's files; only tests/tier_counts.json and tests/README-tiers.md conflicted.

Tier counts by collection on the merged tree: unit 9,796 (master's 9,697 plus this PR's 99), artifact 4,240, integration_psid 1,423, reproduction_legacy 520, oracle_policyengine 308. Total 16,287, matching full collection.

Gates.

• CI is green on b3151f4c.
• Mergeable.
• No change-requested review.
• Independent review agrees (round 6, confirmed by round 7).
• Merged with a merge commit and --match-head-commit b3151f4c, in the slot the microcosm-dynamics coordinator assigned.

Evidence of record.

• All 60 mutants are killed (mutants-r7.json).
• Every engine-confirmed candidate from review rounds 1-5 voids the review.
• The read logs of rounds 5-10 regenerate byte-identical: round 5 is void, and rounds 6-10 count.
• Section 16 of the addendum is untouched; the protocol-hash test passes.

🤖 Generated with Claude Code