[HackingGate]

Why. single-authoritative-source already asks "Can every copy explain its source and refresh policy?". But its applies_when names only services, stores, reports and workflows, so a reviewer reading it against a sentence of prose did not apply it. A review footnote elsewhere restated a platform's documentation with two clauses the page does not say: "before credits", and a measurement of the App's own stated as fact. The footnote passed review.

Change.

• applies_when gains: text shown to readers, such as documentation, help text, a message or a footnote, that restates facts another party owns, such as a vendor's documented behavior.
• review_questions gains: where such text restates another party's facts, does it name the source, and does it say anything as that source's fact which the source does not say?
• A second [[review.control]] for the record in policy/upheld.toml. It plants an uncited, invented clause about osv-scanner's behavior in docs/REFERENCE.md, and its miss is a reflow of the same bullet.
• REVIEW.md, AGENTS.md and review-controls.json regenerated with uphold_check.py --review --emit.

No new record: one incident, covered by an existing record once its scope says so (rule-of-three).

Evidence (Goodhart: the planted change, not the wording). I ran the new control's two sides 10 times each, with a Haiku reviewer fed {document, change} as --drive does:

Document	catches	misses fired
this branch	10/10	0/10
main (before)	3/10 (twice it named Hyrum's Law instead, five times nothing)	not run

The reviewer was a local claude -p wrapper, which this repository does not ship. That gap is filed separately.

Gate: prek run --all-files --hook-stage manual passes.

https://claude.ai/code/session_01EycJ7mGDxJLKzkppTnFNbx

[uphold-review]

uphold-review

Gate alone under this owner: This App runs the gate alone for every pull request under this owner for now, so only uphold's rules ran. Use Full review on the uphold review check for a full review.

✅ uphold rules: uphold's rules pass · this repository's policy at 7bb0050

Rule output

$ uphold scan
policy checks passed

$ uphold check
reconciled 19 enforcement claims:
  explicit-unknown <- catalog-tests  enforced by a hook installed here
  single-authoritative-source <- catalog-reference-current  enforced by a hook installed here
  make-illegal-states-unrepresentable <- catalog-validate  enforced by a hook installed here
  single-authoritative-source <- catalog-tests  enforced by a hook installed here
  explicit-unknown <- no-stale-hook-pins  enforced by uphold guard at manual
  single-authoritative-source <- no-stale-hook-pins  enforced by uphold guard at manual
  complete-mediation <- prevent-ai-author  enforced by uphold guard at commit-msg
  fail-safe-defaults <- prevent-public-push  enforced by uphold guard at pre-push
  observability <- removed-function-named  enforced by uphold guard at commit-msg
  least-privilege <- workflow-declares-permissions  enforced by uphold scan
  minimize-attack-surface <- workflow-declares-permissions  enforced by uphold scan
  compromise-recording <- no-local-merge  enforced by uphold guard at pre-merge-commit
  compromise-recording <- no-merge-commit  enforced by uphold guard at pre-commit
  data-minimization <- no-private-repo-names  enforced by uphold guard at commit-msg
  data-minimization <- no-running-os-identity-metadata  enforced by uphold scan
  chestertons-fence <- removed-function-named  enforced by uphold guard at commit-msg
  deprecation-discipline <- no-stale-hook-pins  enforced by uphold guard at manual
  reproducible-derived-state <- catalog-reference-current  enforced by a hook installed here
  reproducible-derived-state <- review-current  enforced by a hook installed here
  behavior  catalog-tests: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-reference-current: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-validate: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-tests: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  prevent-ai-author: unmeasured [not_requested] — no behavioral probe requested
  behavior  prevent-public-push: unmeasured [not_requested] — no behavioral probe requested
  behavior  removed-function-named: unmeasured [not_requested] — no behavioral probe requested
  behavior  workflow-declares-permissions: unmeasured [not_requested] — no behavioral probe requested
  behavior  workflow-declares-permissions: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-local-merge: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-merge-commit: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-private-repo-names: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-running-os-identity-metadata: unmeasured [not_requested] — no behavioral probe requested
  behavior  removed-function-named: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-reference-current: unmeasured [not_requested] — no behavioral probe requested
  behavior  review-current: unmeasured [not_requested] — no behavioral probe requested
  note  lefthook.yml runs the binary
  note  lefthook.yml defines 20 command(s)
  note  .claude/settings.json runs `uphold hook`
adopted 10 record(s) for design rulings ([decide]):
  explicit-unknown
  parameterize-do-not-enumerate
  enforcement-needs-a-trigger
  psychological-acceptability
  single-authoritative-source
  mechanism-policy-separation
  least-power
  complete-mediation
  fail-safe-defaults
  economy-of-mechanism
  order  fail-safe-defaults over psychological-acceptability: A scope the shim cannot evaluate refuses by default, and `unresolved = "run"` is the named way out.
  order  explicit-unknown over psychological-acceptability: A seam that stands down says so on stderr; it never reports what it did not read as a pass.
  order  psychological-acceptability over complete-mediation: A hook that refuses routine work has its matcher deleted, and then it mediates nothing.
  order  least-power over parameterize-do-not-enumerate: `[stop] run` takes argv and no shell; a command that needs a pipeline names a script.

---

Reviewed with uphold 1.40.0 by uphold-review 0.7.2 · 6e41e18 · claude-haiku-5-5 · 20 s · $0.00 list¹ · $0.00 over 2 sessions

Footnotes

1. List cost as the platform reports it for this session: public list rates, rounded to the nearest cent, before credits or discounts. A rules-only session costs well under a cent, so it shows $0.00. ↩

[coderabbitai]

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.98%. Comparing base (7bb0050) to head (6e41e18).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #462   +/-   ##
=======================================
  Coverage   94.98%   94.98%           
=======================================
  Files          56       56           
  Lines       28550    28550           
=======================================
  Hits        27118    27118           
  Misses       1432     1432           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.