Evidence JSON references local machine paths and non-commit hashes, so it cannot be reproduced #12

New Issue

2026-10-01T22:50:40Z

KofTwentyTwo commented

2026-10-01 22:50:40 +00:00

(Migrated from github.com)

Summary

23 of the 35 files in docs/evidence/ embed /Users/james.maes, /private/tmp or ~/.codex paths (30 occurrences in 2026-10-01-money-presentation-qualification.json alone; 2026-10-01-baseline-merge-verification.json points its log at ~/.codex/work/carl-merge-testing-verify.log). The logs and reports whose SHA-256 they record are not in the repository. docs/ACCEPTANCE.md:7 cites "frozen app 372f094e", which is a jar digest prefix, not a commit; the "frontend commit" cd3d4731 cited in the RC8 and money evidence does not exist in this repository or the foundation. Package-scan counts (240/267/269 packages, zero HIGH/CRITICAL) and browser-check counts exist only inside these files.

What is verifiable

The 37 test method names cited in docs/ACCEPTANCE.md and docs/REQUIREMENT-EVIDENCE.md all exist; the 135 requirement rows match docs/evidence/requirement-evidence.json; the local JaCoCo report (88.0% line, 69.1% branch) is consistent with the baseline-merge evidence.

Suggested resolution

Generate evidence from CI artifacts with one schema, name a committed commit SHA, and attach the hashed logs as workflow artifacts instead of local paths. Same pattern as foundation issue KofTwentyTwo/kof22-agent-foundation#28.

Priority rationale

P1: the acceptance record is the basis for every "qualified" claim and a third party cannot check it.

Filed from the 2026-10-01 real-versus-fake audit of Carl (branch feature/cicd-liquibase-gitops, HEAD 5414d7a, main 1b334d1). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.

## Summary 23 of the 35 files in `docs/evidence/` embed `/Users/james.maes`, `/private/tmp` or `~/.codex` paths (30 occurrences in `2026-10-01-money-presentation-qualification.json` alone; `2026-10-01-baseline-merge-verification.json` points its log at `~/.codex/work/carl-merge-testing-verify.log`). The logs and reports whose SHA-256 they record are not in the repository. `docs/ACCEPTANCE.md:7` cites "frozen app 372f094e", which is a jar digest prefix, not a commit; the "frontend commit" `cd3d4731` cited in the RC8 and money evidence does not exist in this repository or the foundation. Package-scan counts (240/267/269 packages, zero HIGH/CRITICAL) and browser-check counts exist only inside these files. ## What is verifiable The 37 test method names cited in `docs/ACCEPTANCE.md` and `docs/REQUIREMENT-EVIDENCE.md` all exist; the 135 requirement rows match `docs/evidence/requirement-evidence.json`; the local JaCoCo report (88.0% line, 69.1% branch) is consistent with the baseline-merge evidence. ## Suggested resolution Generate evidence from CI artifacts with one schema, name a committed commit SHA, and attach the hashed logs as workflow artifacts instead of local paths. Same pattern as foundation issue KofTwentyTwo/kof22-agent-foundation#28. ## Priority rationale P1: the acceptance record is the basis for every "qualified" claim and a third party cannot check it. --- Filed from the 2026-10-01 real-versus-fake audit of Carl (branch `feature/cicd-liquibase-gitops`, HEAD `5414d7a`, main `1b334d1`). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/carl#12