Skip to content

fix(scan): fail-soft on Loomweave taint-store write errors (1.0.7)#64

Merged
tachyon-beep merged 2 commits into
mainfrom
fix/loomweave-emit-fail-soft
Jun 24, 2026
Merged

fix(scan): fail-soft on Loomweave taint-store write errors (1.0.7)#64
tachyon-beep merged 2 commits into
mainfrom
fix/loomweave-emit-fail-soft

Conversation

@tachyon-beep

Copy link
Copy Markdown
Collaborator

Summary

A bare wardline scan auto-discovers a running Loomweave from its published ephemeral port (ADR-044) with no --loomweave-url flag. On an install without the [loomweave] extra, the opt-in taint-fact write reached require_blake3() and raised LoomweaveError, which the CLI surfaced as a hard exit 2 ("could not run — missing blake3 dep") — killing the gate (the scan's real job) over an optional side-channel's optional dependency.

Reported by a federated sibling (elspeth), whose wardline scan died in exactly this configuration.

Fix

Catch LoomweaveError around the taint-store write and degrade to a not-reachable WriteResult (reported via the existing fail-soft warning + status block), at full parity with the MCP scan tool (mcp/server.py), which already handled this. The write is best-effort enrichment; it never changes the scan's exit code. This covers the missing-extra, 4xx, and bad-scheme cases — closing the whole class, not just blake3.

  • src/wardline/cli/scan.py — wrap the loomweave write; LoomweaveError → not-reachable WriteResult.
  • Realigned the finding-lifecycle glossary line anchors shifted by the fix (docs/reference/finding-lifecycle-vocabulary.md + tests/docs/test_glossary_vocabulary.py).
  • chore: prepare wardline 1.0.7 — bump so the fix reaches PyPI; unblocks elspeth via pip install -U wardline.

Behavior change (intentional)

An explicit --loomweave-url with a 4xx/bad-scheme/missing-extra now degrades soft (warning + completed gate) instead of exit 2. The warning prints on every --format (reporting sits outside the format branch), so it is never silent.

Tests

  • test_scan_loomweave_error_is_fail_soft — replaces test_scan_loomweave_loud_error_exits_2; pins the 4xx case going soft.
  • test_scan_missing_loomweave_extra_is_fail_soft_when_auto_discovered — reproduces the elspeth scenario end-to-end: real resolve_loomweave_url published-port rung + blake3 absent at its genuine call site → exit 0.
  • Full suite: 4201 passed, 18 deselected; ruff + mypy clean; wardline self-gate exit 0.

🤖 Generated with Claude Code

John Morrissey and others added 2 commits June 24, 2026 17:37
A bare `wardline scan` auto-discovers a running Loomweave from its
published ephemeral port (ADR-044) with no --loomweave-url flag. On an
install without the [loomweave] extra, the opt-in taint-fact write
reached require_blake3() and raised LoomweaveError, which the CLI
surfaced as a hard exit 2 ("could not run — missing blake3 dep"),
killing the gate — its real job — over an optional side-channel's
optional dependency.

Catch LoomweaveError around the taint-store write and degrade to a
not-reachable WriteResult (reported with an actionable warning), at full
parity with the MCP scan tool. The write is best-effort enrichment; it
never changes the scan's exit code. This covers the missing-extra, 4xx,
and bad-scheme cases — closing the whole class, not just blake3.

Realign the finding-lifecycle glossary line anchors shifted by the fix.

Reported by a federated sibling (elspeth).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cut the Loomweave taint-store write fail-soft fix as 1.0.7 so a base
install (no [loomweave] extra) that auto-discovers a running Loomweave
can run `wardline scan` again without installing blake3. Unblocks the
federated sibling (elspeth) via `pip install -U wardline`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@tachyon-beep tachyon-beep merged commit fcbd1ee into main Jun 24, 2026
8 checks passed
@tachyon-beep tachyon-beep deleted the fix/loomweave-emit-fail-soft branch June 24, 2026 08:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant